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ABSTRACT 


Modus operandi of various terrorist organizations has been studied extensively, 
and databases sueh as ITERATE collate details about terrorist attacks, to include the 
types of technology used by the terrorist organization and the number of resultant 
casualties. Surprisingly, however, a generalized model of how terrorist organizations plan 
their attacks is unavailable in the extant literature. Drawing from organizational theory, 
particularly the command and control literature and the case study methods, this paper 
posits a generalized model of terrorist attack planning. By extending this model into the 
counterterrorism domain, we consider how to more optimally detect terrorist attacks. 
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I. 


INTRODUCTION 


Terrorist organizations continue to receive significant attention in academic, 
policy and operational circles. Modus operandi of various terrorist organizations have 
been studied extensively, and extensive databases, such as ITERATE, collate details 
about terrorist attacks, to include the types of technology used by the terrorist 
organization and the extent of resultant casualties. Surprisingly, however, a generalized 
model of how terrorist organizations plan their attacks is unavailable in the extant 
literature. Drawing from organizational theory, particularly the command and control 
literature, and through synthesis of three case studies, this paper posits a generalized 
model of terrorist attack planning. By extending this model into the counterterrorism 
domain, I consider how to more optimally detect terrorist attacks. 

A. DEFINITIONS 

Definitions of terrorism have received significant scrutiny and debate, with little 
resolution (Post et ah, 2002, p.74). Eor the purpose of this work, we use a definition 
developed by the U.S. Department of Justice, which defines terrorism as “the unlawful 
use of force or violence committed by a group or individual against persons or property 
to intimidate or coerce a government, the civilian population, or any segment thereof, in 
furtherance of political or social objectives.” (Grimmer, 2007) Efforts by representatives 
of the state to prevent or deter such unlawful uses of force or violence will be classified 
as counterterrorism. Thus counterterrorism, in this work, includes efforts to stop the 
formation of terrorist cells, stop the planning of events that may lead to terrorist attacks 
and finally stop the execution of attacks. Other definitions needed for this paper include: 

Counterterrorism Specialist - any individual whose occupation is related 
in any way to executing counterterrorism measures, as defined in 
the above paragraph. This will include everyone from intelligence 
analysts all the way down to the street cop of a local township. 
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Organized Crime - “any group having a corporate structure whose 
primary objective is to obtain money through illegal activities, 
often surviving on fear and corruption” (Thomas, Kiser, and 
Casebeer, 2005, p.37). 

Terrorism analysis continues to prove a diverse and changing field. Studies often 
range from analysis at an organizational level all the way to specific analysis of the 
events (Jackson, 2005; National Commission on Terrorism Attacks, 2004). 
Organizational analysis is often very difficult due to the secretive nature of these groups; 
as a result, a look inside the organization can prove opaque at best. Conversely the idea to 
study terrorist activity on an event by event basis will often simply focus on the actions 
and not take other factors into consideration such as group dynamics and motives. Thus, 
in order to fully understand the operations and executions of terrorist organizations, one 
must consider the context - including background, environmental and situational factors 
affecting that particular terrorist cell as well as specific events leading up to an attack - of 
the group’s actions (Crenshaw, 1995). By considering all of these factors in conjunction 
with one another, a richer picture is created, leading to the discovery of self-emerging 
patterns. From these patterns, a generalized model of terrorist attack planning can emerge 
as a significant contribution to the field of terrorism studies. 

B. ORGANIZATIONAL AND OPEN SYSTEMS PERSPECTIVE 

This paper focuses on terrorism at the organizational level in order to examine 
how the work of terrorism is conducted, rather than a societal level that might seek to 
explain why terrorism comes into existence under particular circumstances. Consistent 
with emerging trends in the literature (Thomas, Kiser and Casebeer, 2005, eh. 1), this 
paper views terrorist organizations with an open systems perspective, recognizing that 
terrorist organizations both draw from and influence the environments in which they are 
situated (Thomas, Kiser and Casebeer, 2005, eh. 1). Through understanding the flow of 
resources and feedback across the boundary between terrorist organizations and their 
environments, counterterrorism analysts may be able to more optimally interrupt the 
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work processes upon which terrorist organizations depend for successfully producing 
terrorist attacks. Creating such an understanding involves answering questions such as: 

1. What do terror cells require or prefer within their environment in order 
to be successful? 

2. How can law enforcement and surveillance teams detect and destroy 
these preferences? 

3. Are there things that can be placed within an environment in order to 
assist authorities and continue to deter terror cells? 

C. APPLICABILITY OF CASE STUDY METHOD 

This work builds on theory about terrorist attack planning via comparative case 
studies (Eisenhardt, 1989; Eisenhardt and Graebner, 2007) a common research method 
within terrorist studies (Jackson et ah, 2005). Terrorist organizations have been described 
as complex, adaptive systems (Roberts, 2003), responding to changes in their 
environment. However, any functional terrorist group or cell must operate within the 
confines of its environment and resources; as such, the feasible space of their actions and 
behaviors is bounded, and selection of tactics is limited. Thus one advantage of the case 
study method is that since these cells act independently, any correlation or consistency 
one finds between how groups conceive, plan, resource, and execute their operations 
suggests that social or environmental factors, not shared leadership, is primarily 
responsible for any discernible differences. By abstracting past attempts at terrorist 
attacks, a generalized model of terrorist attack planning will emerge. This generalized 
model, in turn, will assist counterterrorism professionals with developing or enhancing 
tactics to interdict future terrorist attacks. 

One thing this model must take into consideration is the assertion that terror cell 
origins today have changed from the origin of terror cells like the 9-11 attackers. “[There] 
was a shift from an A1 Qaeda operational model based on an ‘all-star team’ of operatives 
that was selected, trained and dispatched by the central leadership to the target, to an 
operational model that encourages independent “grassroots” Jihadists to conduct attacks, 
or to a model in which A1 Qaeda provides operational commanders who organize 
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grassroots cells. We refer to this shift as devolution because what we are seeing now is 
essentially a return to the pre-9/11 model” (Burton, The Continuing Devolution, 2006). 
Taking this perspective into account, I have picked three case studies for this analysis. 
Two of the terrorist attacks were conceived of and thwarted prior to the 9/11 attacks; one 
was thwarted following the 9/11 attacks. An additional restriction on the case studies 
chosen include that the plots must have been stopped prior to execution. The goal is to 
choose a variety of different cells in hopes that any trends observed will not be dependent 
on the type of cell or plot attempted. 

With that in mind, this work conducts primary research into the following three 
thwarted terrorist attacks: 1) the Brooklyn Bridge attack by lyman Paris, 2) the Millennial 
Bombings at the Los Angeles Airport, and 3) Operation Bojinka, a plan in the mid-90’s 
to attack airliners over the Pacific Ocean along with a series of simultaneous attacks 
around the world. Occasionally, we will make reference to other terrorist attacks in order 
to better illustrate a specific point. However primary research will be placed on terror 
plots outlined above. Directly stated, this paper uses case studies of thwarted attacks as a 
primary source material to investigate if a generalized basic model of terrorism action 
exist in hope of assisting in the development or enhancement of U.S. counterterrorism 
tactics. 
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II. CASE STUDIES 


This section will explain each case study and its contribution to the more 
generalized model towards the end of this paper. 

A. MILLENNIAL BOMBING 

The attempted attack on the Los Angeles airport in 1999 was primarily carried out 
by Ahmad Ressam. Ressam first became interested in jihad while a member of a poor 
Muslim robbery gang in Montreal, Canada. He had come to Canada in 1994 with a fake 
French passport and a request for political asylum based on an untrue story. The gang that 
Ressam joined would often steal identifications, luggage, money and sometimes 
computers from tourists and exchange them with a man named Mokhtar Haouari for 
money (Ollen, July 5, 2001, p.588). Haouari was involved in bank fraud and false 
identification laundering. In the summer of 1997, many of Ressam’s friends attended an 
Afghani training camp to become Muslim jihadis; by March of 1998 Ressam was also 
traveling to an Afghani training camp by way of Pakistan to train (Ollen, July 3, 2001, 
p.536-41 544-6). 

In Afghanistan, trainees were organized by ethnicity. All Algerians were to train 
in a group that would be further broken into functioning cells. An Algerian, Ressam was 
assigned to a cell under the leadership of Abu Doha (Ollen, July 3, 2001, p.549). When 
scoping a target, Ressam was taught: 

1. Look like a tourist; 

2. Spend much time surveying your site; 

3. When working in a cell preserve your secrets, everyone operates on a need to 
know basis; and 

4. If speaking on a phone talk normally and controlled or speak in another 
language. 

(Ollen, July3, 2001,p.551-2). 

He was also taught general tactical training, marksmanship and bomb 
manufacturing. Ressam’s cell designed a plot to attack an airport in California. They 
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would separately travel to Canada by way of Pakistan, meet up in Montreal, fund their 
plot through robbery and theft and when ready, travel into California to execute their plot 
(Ollen, July3, 2001,p.553-4). 

Ressam was the only man who was able to make it back into Canada after their 
training (through false stories for requesting asylum); the rest of his cell was detained in 
Europe. Ressam was actually being tracked by immigration while in Canada but was not 
apprehended. Despite his teammates being unable to join in Canada, Ressam decided 
with Doha that Ressam would still complete the planning of this attack. On his flight 
back to Canada, Ressam brought Hexamine tablets and liquid glycol, a notebook with 
bomb-making instructions and $12,000 cash. This cash was to be used to buy a house and 
purchase weapons (Ollen, July 3, 2001, p.559-60). 

In Montreal, Ressam restored communications with Haouari and continued 
participating in burglary and credit card fraud which would be used to fund his plot. 
Furthermore, Ressam obtained an immigration visa through false employment at mutual 
friend’s business. In the summer of 1999 Ressam began active planning of his plot; if he 
spoke to Doha or Haouari it was usually in Arabic. Doha, located in London, talked to 
Ressam via a pre-paid cell phone plan to discuss details. The first step was to ensure that 
all of Ressam’s false identification and papers were in order. He started researching 
locations to purchase explosive chemicals. He also purchased a map of the United States, 
putting three circles around California airports (Ollen, July 3, 2001, p.572-3). 

By August of 1999, Ressam decided the plot would consist of loading a bomb 

into a suitcase. He would leave the bomb unaccompanied in the Los Angeles airport and 

set it to detonate on a predetermined timing device. The location would be chosen by 

leaving an empty suitcase in different locations to see where it would draw the least 

amount of attention. By September, Ressam bought his electronic components that would 

be needed for the bomb such as electronic circuits and the timing device. In November he 

was making frequent trips to Vancouver where he would stay with friend, Abdelmajid 

Dahoumane, while he bought unsuspicious amounts of urea and aluminum sulfate from 

garden shops - both of which can be manipulated into highly explosive fertili z ers. 

November was also when Ressam informed Haouari about “business” in the United 

6 



States and asked for financial support, which Haouari complied by using money from his 
store. He and Haouari also spoke about previous plots that were conducted in France and 
agreed that similar attacks should take place again (Ollen, July 5, 2001, p.589). Haouari 
was also prepared to introduce Ressam to a friend in New York, Abdelghani Meskini that 
would assist Ressam with his plan. Ressam only agreed if Meskini was not known to 
work in Islamic movements (Ollen, July 3, 2001, p.574-8). 

On November 17, 1999, Ressam left by airplane for Vancouver with his fake 
license, $3,000 Canadian from Haouari, approximately $5,000 of his own money and the 
timing devices to purchase the last amounts of the explosive materials he would need for 
his bomb (Ollen, July 3, 2001, p.584). He spent two weeks in Vancouver preparing the 
explosives with chemical instruments and stealing nitric and sulfuric acid (with the help 
of Dahoumane) from a fertilizer manufacture before heading back to Montreal one last 
time (Ollen, July 5, 2001, p.592-4). Between the times that Ressam left Vancouver and 
ultimately headed for the U.S. border he had a flurry of phone calls to Haouari, Meskini 
and others to organize last minute details for the plot and post-plot operations. Secretive 
phone calls would be done over pay phone with a phone card; all other calls were simply 
completed on his cell phone. On December 6, 1999, Ressam flew to Vancouver. While 
there he stayed with his friend Dahoumane at a local hotel. During this visit Ressam and 
Dahoumane assembled the bombs that would be used in the attack. The morning of 
December 14, 1999, Ressam brought his cell phone, cash and passport (with pages 
stamped by Afghanistan ripped out) to the rental that he had loaded with bombs into the 
trunk the evening before. Ressam took the ferry from Victoria to Port Angeles. Ressam 
was stopped at customs and asked what he was doing, Ressam’s little English and slowed 
response raised the guard’s suspicions. When they began to search his car, Ressam got 
nervous and tried to flee but was apprehended before getting away. It should be noted 
that although this plot was primarily created and executed by Ahmed Ressam, he was 
given assistance by at least three to four other people not mentioned in court documents 
(Ollen, July 5, 2001, p.603-7, 613). 

This plot is an ideal case to study due to the large amount of information about 
each stage of the planning. It has an airport as a target which is common of today’s 
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targets; commercial aviation, airports and large public spaces have long been significant 
targets for terrorist groups (Security Alert, 2003; Drake, 1998). Additionally, this plan 
was organized and produced outside the U.S. and then moved inside the U.S. borders 
with the execution date approaching, another significant concern of counterterrorism 
specialists, particularly when those cell members are coming across one of our two 
adjacent borders: Canada or Mexico. A final interesting factor in this particular plot is the 
fact that the majority of this plot was planned and executed by one man: Ahmed Ressam. 

B. BROOKLYN BRIDGE PLOT 

The second plot that will be analyzed is the attempt to destroy the Brooklyn 
Bridge by lyman Paris. The Brooklyn Bridge plot was already conceived by top members 
of A1 Qaeda leadership including Khalid Shaikh Mohammed and Majid Khan but was 
placed upon an independent member, Paris, to research its feasibility. Paris, a naturalized 
citizen of the United States and a relative of Majid Khan, traveled to Afghanistan by way 
of Pakistan. He was tasked by top operatives of A1 Qaeda leadership to return to the U.S. 
to see if it was possible to use certain tools to derail a train while simultaneously 
destroying the Brooklyn Bridge. Before officially working on this project, operatives 
gave him menial tasks to complete while he waited in Pakistan; he was tasked with 
obtaining extensions on airplane tickets and delivering bags of money and cells phone to 
an assigned recipient, which he completed by disguising himself as a Muslim Missionary 
(Sinclair, 2003, p.1-2). By April 2002, Paris was back in the United States; there he 
conducted independent research to discover ways to carry out this plan. He was instructed 
to use the word gas stations for the metal cutters that would bring the bridge down and 
mechanic shops for tools needed to derail the train. He was also instructed to never check 
his email directly after signing onto the internet, always check at least one other site first. 
After conducting research on the internet for metal cutters, Paris approached an 
acquaintance that he knew to have some experience with these tools and asked for further 
information. Between April 2002 and March 2003, Paris struggled to locate information 
on the two tools he was looking for and sent several coded messages back to Khan in 
Pakistan relaying that he was still searching. After researching and observing the bridge 
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as a potential target for over a year, Paris sent a message baek to Khan saying the weather 
is too hot, eonveying that the plot would be unlikely to suceeed due to the seeurities and 
surveillanee assoeiated with the target (Sinelair, 2003, p.3). Through physieal and 
eleetronic surveillanee, counterterrorism authorities became suspicious and Paris was 
apprehended for conspiring with a known terrorist organization (Donald H. Rumsfeld, 
2003). 

This plot is chosen in particular because it was planned after the attacks on 
September 11 as such also planned with the Patriot Act in place. Although this plot never 
left the researching phase, it did show a significant amount of communication between 
cell members and A1 Qaeda hierarchy which is not necessarily as prevalent in other plots. 
It also shows how trust between members is developed; Paris had never met anyone in A1 
Qaeda leadership but due to his relationship to Khan was able to work with the 
organization. By having so much communication and developing relationships present in 
this plot, methods are able to be analyzed for patterns. 

C. OPERATION BOJINKA OR MANILA AIR 

Pinally, Operation Bojinka was a plot financed by the infamous A1 Qaeda leaders 
Osama Bin Laden and Khalid Shaikh Mohammed (KSM) and masterminded by 
Mohammed’s nephew Ramzi Ahmed Yousef. It was a compilation of many different 
plots all brought together under an all encompassing plan. This plot targeted twelve U.S.- 
bound airliners with a majority of those flights destined for large cities in the United 
States in which bombs would be placed under seats near the fuselage that would detonate 
in flight. Additionally, one of those planes would possibly be used to crash into a 
strategic U.S. target like the CIA or PBI buildings (Department of Transportation, 
Washington, DC Metropolitan Area, 2003). Simultaneously there would be an attack on 
the U.S. Embassy in Manila and a subsequent assassination of the Pope who would be 
visiting Manila at the same time. Yousef originally came to the U.S. in 1992 requesting 
asylum as an Iraqi dissident. Only five months later he executed the first World Trade 
Center Bombing while working with a cell in New York. By August of 1994 Yousef 
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traveled to Manila in the Philippines to begin the planning of this operation (Department 
of Transportation, Security of Checked Bags, 1999). 

Yousef’s cell in Manila consisted of childhood friend Abdul Murad and a third 
man named Wali Khan Amin Shah. Investigation of the laptop recovered after the plot’s 
discovery suggested that there were at least five members to this cell, however the three 
listed above are the only known conspirators to date (Department of Transportation, 
Security of Checked Bags, 1999). The cell worked out of an apartment located near the 
U.S. Embassy, Manila; these three tenants were very suspicious and were reported to 
often have chemical burns on their hands. During their preparation for this flight, 
“Yousef compiled detailed flight data on the twelve aircraft, including their departing 
times, flight numbers, flight durations and aircraft types, and transferred this information 
to his laptop computer. In early November 1994, Yousef placed a large order for 
chemicals and equipment in Manila, and, during the next two months, he and his co¬ 
conspirators performed several tests in preparation for the aircraft bombings. On 
December 1, 1994, Yousef and Shah conducted a test by placing a bomb under a patron’s 
seat at the Greenbelt movie theater in Manila. At 10: 30 p.m., the bomb exploded, 
injuring several people” (Kelley and Garcia, 2003). Directly after this explosion, Shah 
left the Philippines to travel in the Middle East and then returned a few weeks later under 
an assumed name. 

This plot reached a test execution phase by December 11, 1994 when Yousef 
tested airport security by creating a bomb one-tenth the planned size. He assembled it on 
board Philippine Airlines Plight 424 from Manila to Tokyo in the bathroom and then 
placed it under a seat where it would detonate. Yousef deplaned in the Philippine City of 
Cebu and the bomb ultimately detonated on as the aircraft continued to Tokyo. This 
bomb was not designed to destroy the plane, only test whether such an operation was 
feasible. Yousef had accomplished that goal (Department of Transportation, Security of 
Checked Bags, 1999). 

This plot was uncovered by Philippine officials when there was a chemical fire in 

the apartment being rented and officials recovered many of the bomb making supplies 

located within. “Homemade explosives, batteries, timers, electronic components, and a 
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notebook full of instructions for building bombs were discovered. Subsequent 
investigation of computer files taken from the apartment revealed the plan in which five 
terrorists were to have placed explosive devices aboard United, Northwest, and Delta 
airline flights. In each case, a similar technique was to be used. A terrorist would fly the 
first leg of a flight out of a city in East Asia, plant the device aboard the aircraft and then 
get off at an intermediate stop. The explosive device would then destroy the aircraft as it 
continued on the subsequent leg of the flight to the United States” (Department of 
Transportation, Security of Checked Bags, 1999). This is also where the Philippine 
officials discovered evidence that this cell was likely being funded by Osama Bin 
Laden’s brother-in-law, Mohammed Jamil Khalifa since “police retrieved Khalifa’s 
business card from the ruins” (Sanchez, 2004). 

This paper researches Operation Bojinka because the sheer size of this plan, this 
plot was a huge undertaking by the Manila cell. It exemplifies a typical A1 Qaeda plan 
which is generally quite elaborate being made up of many different pieces all working 
together with detailed planning and coordination, as well as and extensive pre-execution 
rehearsal and testing. This also creates a situation that provides for large amounts 
observable evidence. As stated above, it uses an airplane crash as part of the plot which is 
also ideal since today’s larger plots are including scenarios very similar to part of 
Operation Bojinka’s objectives. Additionally it was planned and designed before the 
attacks on September 11, 2001 and the introduction of the Patriot Act. Some schools of 
thought suggest that since A1 Qaeda’s hierarchy has now been disrupted and its 
leadership driven underground, that the terror cells of today have actually reverted back 
to pre-September 11 style planning. That is, broad based guidelines by A1 Qaeda 
leadership with command structure and specific details left to individual cells, making it 
extremely beneficial to also study these types of scenarios (Burton, The Lessons of the 
Library Tower Plot, 2007). 

Based on the three case studies and buttressed by similarities with other attacks 
that complement this work but have not been developed to the level of full case studies, it 
seems clear that terrorist attacks consist of three major phases and two decision points. I 
have termed the three phases as 1) conception, 2) acquire resources, and 3) execution. 
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The decision points are labeled as decision to move forward with the concept, and 
decision to move forward with execution. In the subsequent sections, I discuss each of 
these phases and decision points in turn, with particular emphasis on their implications 
for counterterrorism specialist and policymakers. 
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III. PHASE I - CONCEPTION 


To analyze a terrorist plot from beginning to end, one must begin with the 
question: where do terror cells originate? The subsequent paragraphs will outline what 
common variables exist in the creating of a terror cell. This paper does not claim that 
terror cells will derive from the information presented, however it does submit that when 
such variables are present the likelihood of creating a terror cell increases. For example, 
Thomas Kiser and Casebeer (2005, p.86) claim that “a given ethnicity in a country that is 
also poor, politically disenfranchised, and has a unique religion is far more likely to be 
the basis or source for a VNSA [Violent Non-State Actor] than a pre-existing identity 
cleavage”. 

A. CREATING A TERRORIST: ANALYSIS OF THE INDIVIDUAL 

“Several organizational processes are necessary for a group survival and growth - 
recruitment, screening, socialization, training, assignment and promotion, and attrition” 
(Post et ah, 2002, p.90). Each of these processes, although necessary for overall group 
survival are not all required during Plot Conception, however each process will be 
discussed throughout this paper. It is important realize that as a cell progresses through 
plot conception to execution a counterterrorism specialist will want to look for these 
types of processes. 

Potential Candidates. Although A1 Qaeda terrorist cells generally consist of 
middle-eastern males ranging in age from 18 to 37, this can not be a definitive profile. 
John Holschen, Regional Manager of Triple Canopy (2007), reaffirmed this statement in 
his presentation at the 2007 Trexpo West Conference located in Long Beach, California 
saying “You can not base terror profiles on ethnicity”. Usually terrorists derive from two 
sources: either the individual has family that is already involved terrorist activity or the 
individual will convert to extreme Islamic practices. Often these individuals have varying 
backgrounds but share a similar ideology (Thomas, Kiser and Casebeer, 2005, eh. 1-2). In 
particular, individuals that are young and still developing their belief base are 
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impressionable for terrorist groups; further, they will likely not have a family or 
responsibilities that may deter them from giving their life to a cause. 

Common social network. Cell formation often centers on a common social 
meeting place. This was seen in “1999 when many of al-Masri’s associates, including his 
son, were arrested in Yemen in connection with bomb attacks staged by militant Islamist 
group the Aden-Abyan Islamic Army along with another group. Supporters of Shariah” 
(Londonistan, 2005). “The mosque has served as a rendezvous point for A1 Qaeda 
handlers/feelers and potential local operatives. Once an A1 Qaeda manager has made first 
contact, further meetings are held only in private, to reduce the risk of detection. But the 
mosque has in the past offered the network ideologically indoctrinated British recruits” 
(Londonistan, 2005) “major influence was the social environment of the youth” (Denny, 
Post, Sprinzak, 2003, p.l73) if a child has grown up in a community that sympathizes 
terrorist exploits, that individual is more likely to follow the same pursuits in later years. 

Establishing Cell Membership. The first step in a terrorist plot is to establish a 
cell. An individual who wishes to execute terrorist activity generally recruits the 
assistance of like-minded others. He will do that by gaining interest of a group of 
individuals and then establishing “acceptable versus unacceptable members” (Post et ah, 
2002, p.90). Interest is generated by “exploiting identity and mobilizing the individual 
along similar lines, either by creating competing identities where none previously existed 
or exacerbating existing identity differences, is an important aspect of the individual’s 
conversion from citizen to VNSA [Violent Non-State Actor] member” (Thomas, Kiser 
and Casebeer, 2005, p.63). If strong ideological fissures exist within the community of 
potential recruits, the process of converting sympathizers to fully-participating violent 
non-state actors is aided. The cell may consist of a group of scattered individuals that 
meet via the internet or in person; when groups member share a common ideology, the 
common ideas become magnified and exaggerated. As a result, themes of violence or 
revenge that may be faint among individuals come to dominate discourse in a group 
setting. An additional risk of terrorist cell formation occurs when there is an agitator 
present (Post et ah, 2002, p.89). For example, the four members of the 9-11 conspirators 
that were located in Hamburg for a short period were known to be in a group that spoke 
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about anti-American sentiments. “By the time Atta, Shehhi, and Binalshibh were living 
together in Hamburg, they and Jarrah were well known among Muslims in Hamburg and, 
with a few other like-minded students, were holding extremely anti-American 
discussions.... As time passed, the group became more extreme and secretive. According 
to Binalshibh, by sometime in 1999, the four had decided to act on their beliefs and to 
pursue jihad against the Russians in Chechnya” (National Commission on Terrorism 
Attacks, 2004, p.3-4). 

Post (2002, p.l06) claims that if “the literature and communications of a 
community of belief shift into advocacy of violence against certain targets,” then this is a 
strong indicator that a group is shifting from a discussion forum to a more radicalized 
stance that could eventually include violent political actions - including terrorist attacks. 
Interestingly, the influence of such discourse can extend well beyond the explicit 
membership of the group to observant, yet “outsider,” individuals. For example. Post et al 
(2002, p.89) describe Timothy McVeigh, responsible for the bombing of Alfred P. Murah 
Federal Building in Oklahoma City as “not a formal member of any of the militia 
organizations or other right-wing groups whose ideology he espoused and acted on”. 

Another indicator that a group may be shifting to violent extremism is a change in 
recruitment process or recruitment of a certain type of individual. “Groups that recruit 
from pools including violent, disgruntled, disenfranchised, victimized, or radicalized 
personnel, such as the Lautaro Youth Movement in Chile, or the recruitment of 
unemployed disgruntled youth in the Gaza strip, or personnel with specialized training or 
experience suitable to violence are more likely to pursue violence and terrorism” (Post et 
ah, 2002, p.90-91). When a counterterrorism specialist is trying to determine whether a 
terror network may be recruiting in their area, key indicators include: 

1. Individuals with a history of legal conflicts with government or criminal 
actions; 

2. Individuals that demonstrate a history of violent behavior or experience with 
weapons, including participation in military training, paramilitary or other 
violent organizations, or violent campaigns; and 

3. Individuals with special educational background (e.g., microbiology), or 
specialized skills (e.g., explosives) (Post et al., 2002, p.91). 
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Once a group has been discovered as actively recruiting, another indicator would 
be to look at how selective they are being in their recruiting. “Groups who are a risk for 
terrorism are more likely to select and screen more selectively” (Post et ah, 2002, p.91). 
One would also want to be mindful of groups that stress such values as “obedience to 
authority, absolute loyalty to the group and leader and the need for sacrifice” (Post et ah, 
2002, p.91). Conversely, while a group is screening individuals there will be members 
coming and also members leaving for any variety of reasons. A few reasons why a 
member would leave could include disagreement with the new group direction, difficulty 
to adhere to the strict roles within the group, or a member is executed or expelled from 
the group for questionable loyalty or security. Sudden losses to an organization could 
indicate this heightened screening process or an increased seriousness to the goals of the 
group which could be indicative of terrorist activity. (Post et ah, 2002, p.93). 

As seen many times in the case studies presented above, trust is a major issue 
within this lifecycle. Javier Jordan (2005, p.l79) even ventures “in general, Jihadis are 
reluctant to trust converts”. If a terrorist knew someone or a person were suggested to 
them by a friend, they would be much more likely to work that individual. In the LAX 
plot, Ressam agreed to work with Meskini because of a suggestion by Haouari, a person 
that Ressam trusted very much. A large portion of the questioning in Ressam’s cross- 
examination in Haouari’s case dealt with this fact. (Ollen, July 5, 2001). Likewise in the 
Brooklyn Bridge case, lyman Paris was introduced to Osama Bin Laden and Khalid 
Shaikh Mohammed because of his relationship with Majid Khan. However, Paris was 
required to perform certain tasks like order sleeping bags with Majid, transport money 
and cell phones to a given destination and transfer airplane tickets at a local travel agency 
in order to prove his loyalties. Pinally, Yousef asked his friend Murad to help with his 
plot to destroy American-bound airliners because they had been friends since childhood. 
Thus it can be surmised that previous relationships and trust are quite crucial to these 
types of operations. 
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B. ORIGIN OF TERROR PLOTS 


Now that a source of violence extremism is established, the next step is to analyze 
where these groups establish their ideas for a plot. The reality is that ideas exist because 
the environment that those ideas exist in is conducive to their existence and proliferation. 
Ideas are only furthered if they are supported and nurtured. For example, a child who is 
raised going to church will grow up still going to church because that is what they were 
taught to support as a child. “Support (at least passive and ideally active) of the 
population in which a terrorist organization lives is, except in unusual cases, a practical 
necessity for the organizations survival” (Thomas, Kiser and Casebeer, 2005, p.81). Ideas 
are supported because a strong belief is sponsored. In general religious extremism is 
supported by local family and community members (Denny, Post and Sprinzak, 2003, 
p.172). 

Ideas for terrorist attacks come either from lower level members of the terrorist 
group (a “bottom up” idea) or from the group’s senior leadership (a “top down” idea). In 
terms of a timeline for plot conception, the Millennial Bombing was conceived over five 
to six months. Ressam and other cell members were brainstorming at the Afghani training 
camps from approximately March to December of 1998 during discussions with 
Ressam’s Algerian cell. As such, this plot is an example of a bottom-up idea. Since they 
were training in Afghanistan at the time of the plot conception, the cell members found 
themselves in an environment that not only promoted Islamic extremism; it actually 
taught individuals how to be successful at it. Towards the end of their training this cell 
discussed moving forward with one of the ideas they had discussed: an attack on a U.S. 
airport by using a bomb. 

The timeline for the attempt to destroy the Brooklyn Bridge is unknown due to the 
source of this plot. This plot is an example of a top-down creation; the plot had already 
been conceived by higher ranking members of A1 Qaeda and lyman was tasked with 
establishing its validity. Thus this plan, at the time when this case study begins has 
already moved past conception and into the decision to acquire resources and information 
on the target. 


17 



Operation Bojinka is a top-down plot that was conceived by Ahmed Yousef over 
a period of approximately one year; the ambiguity lies in the fact that the first World 
Trade Center bombing took place in 1993 and Yousef was flying to the Philippines by 
August 1994. Somewhere in that timeframe there was a plot conception and a decision (at 
the very least) by Yousef to move it to the next phase of acquiring resources. Conception 
of this plot was formulated based on a series of other attempted plots all pulled together 
under one plan; this type of plot is very fa mi liar to terrorist groups like A1 Qaeda. There 
has been speculation that the idea to crash a plane into a known U.S. landmark was 
inspired by Frank Eugene Corder who failed to crash his Cessna into the White House 
only four days before planning began on Operation Bojinka. Additionally, these terror 
cells are known for thinking big, with many things happening simultaneously. Fred 
Burton (The Lessons of the Library Tower Plot, 2007), author of many Stratfor 
publications, states that A1 Qaeda is “capable of keeping several plots in motion 
simultaneously and of adapting to new security considerations on the fly, at least while 
the core communications and logistics network remained intact”. Cells will use past 
events as inspiration for future plots. A1 Qaeda is especially known for using previously 
successful plans again and again with slight variations on a theme (Burton, The Lessons 
of the Library Tower Plot, 2007). Homegrown terror cells will be no different; many of 
them will be looking to the past for inspiration on future attacks. 

C. CHARACTERISTICS OF CONCEPTION PHASE 

During the initial conception of a plot there will not be as many people involved 
when compared to later stages of plot development. For the Millennial Bombing, 
brainstorming began in the Algerian Cell that had been formed at a training camp in 
Afghanistan. Each cell that was formed in Afghanistan had a leader as well. This man 
was in charge of providing direction for the cell and approving ideas that the cell may 
have created. The leader of this particular group in Afghanistan was Abu Doha. Although 
there are no specifics available on who specifically designed this plot, it is known that it 
was some section of A1 Qaeda hierarchy which would be an inherently small group. Not 
as much information is documented about the origins of Operation Bojinka, but it is 
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believed to have been masterminded by Ramzi Yousef relative of Khalid Shaikh 
Mohammed. In this plot, once the plan was finalized it was all placed onto a laptop for 
safe keeping. 

Before the cell can move into the next stage there must be enough discussion that 
the cell believes that this is a feasible plot; this means that the cell needs to be assured 
that it has enough support to complete the task. “The type of support a group receives can 
range from ideological, financial, and material to operational, including weapons, 
training, logistics, advisors, and troops. A radical group receiving operational support is a 
greater risk for terrorism than one receiving only ideological and financial support” (Post 
et ah, 2002, p.95). For each cell, this time frame to reach the point where the cell is 
comfortable with moving forward with concept is different. In Operation Bojinka Yousef 
took nearly a year to develop a plot before he contacted childhood friend, Murad, to 
move to the next stage. Likewise the Brooklyn Bridge plot was created by A1 Qaeda 
hierarchy to form a general plan before consulting any other outside sources. Finally the 
plan for the Millennial Bombing was thoroughly discussed before it was presented to 
their leader Abu Doha for approval. 

If it is not already apparent, this stage is rather difficult to monitor, since there are 
not as many players. Furthermore, the cell must wait to move to the next stage until they 
feel safe that everyone involved in the brainstorming will agree to move forward and that 
their efforts will be successful. Synthesizing our knowledge of the genesis of these three 
plots points to a few pieces of critical understanding about terrorist attacks. 

First, ideas for terrorist attacks stem from all levels of the organization, from new 
recruits to senior leadership. In conceiving of terrorist attacks, then, terrorist groups are 
limited only by 1) the creativity of their members, 2) communication processes through 
which new ideas are offered to the group, and 3) the limitations on group processes 
generally credited with fostering collective creativity. “When individuals do not have the 
necessary expertise, ability, or motivation to generate creative solutions alone, they 
sometimes find ways, through moments of collective effort, to produce creative 
outcomes” (Bechky and Hargadon, 2006, p.l). For counterterrorism specialists, then, 

interrupting communication between group members can reap significant dividends 
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during the conception process - without feedback from peers on whether a particular idea 
for a terrorist attack is acceptable, the concept is likely to sit fallow. Second, as Post and 
others have elucidated, terrorist attacks must be consistent with the ideology of the 
participating members - i.e., the attacks must seem to fall within the normative values of 
the cell emerging to undertake the plot development. If the proposed attack is inconsistent 
with the ideological underpinnings that draw the group together, it is unlikely to be 
developed further. Between groups, these ideological underpinnings can be varied and 
inconsistent - for al Qaeda, for example, complex and sophisticated attacks that hit 
multiple U.S. sites simultaneously becomes the bulwark of action. For Timothy 
McVeigh, the symbolism of anti-government protest becomes embodied in the selection 
of the Murrah building as an appropriate target. Counterterrorism specialists thus may 
wish to explore and understand the ideological underpinnings of the groups most likely to 
conceive of and execute terrorist attacks; appreciating these ideological underpinnings 
will assist counterterrorism specialists toward understanding the target selection process. 
Third, terrorist attacks must be considered feasible by involved group members, which 
can include lower-level personnel as well as senior leadership. If an attack is considered 
infeasible, further development of the idea is unlikely to occur. Before counterterrorism 
specialists create preventive actions for a certain attack, they will want to consider 
whether that group in question would consider a specific attack plausible. Fourth, terrorist 
groups are often preoccupied with previous targets (Burton, The Lessons of the Library 
Tower Plot, 2007; Ollen, July 5, 2001, p.589) and using existing repertoires of action 
(Tilley, 2006) so in many situations looking to the past may in fact be a blueprint for 
future activities, counterterrorism authorities will not want to ignore these past events 
when preparing for the future. 

D. DECISION TO MOVE FORWARD WITH CONCEPT 

There is considerably more preparation involved with plan conception than with 
the decision to move forward. This part of the plot’s progression is generally a meeting or 
a series of meetings to ensure that everyone has bought in and they can accomplish their 
task. Depending on the command and control structure of the group, the decision 
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authority for moving forward with the concept can vary considerably. Some groups will 
maintain this decision authority as the senior reaches of the organization, while other 
groups will allow lower-level units a considerable amount of leeway for conceiving of 
and planning its terrorist attacks. 

The Millennial Plot represents a command and control structure that resembles 
Mintzberg’s simple structure (Mintzberg, 1989, p.111-12). For the Millennial Plot, at 
some point while Ressam’s cell was in Afghanistan training, the cell finished their 
discussions and submitted their plot for review by the cell leader, Abu Doha. Doha 
approved their idea to attack an airport in the United States. The specific planning for this 
plot would commence in Montreal once they had finished with their training. When they 
left the training camp they were to each travel to Montreal separately and convene at a 
specific location each bringing a certain amount of money to initialize their planning. 
Ressam carried $25,000 with him into Canada. When no one else in the cell was able to 
reach Montreal, Ressam through discussion with Doha made the decision to move 
forward with the plot. 

In contrast, the Brooklyn Bridge plot represented a command and control 
structure that resembles Mintzberg’s Machine Bureaucracy (Mintzberg, 1989, p. 111-12). 
The decision to move forward with the Brooklyn Bridge plot took place within the upper- 
echelon of A1 Qaeda leadership, specifically Majid Khan and KSM in early 2002. 
However, even though members decided to move forward with the plot, it was agreed 
that the plan needed further research to see whether or not it was even feasible to 
complete the attack. Present at this meeting to move forward was lyman Paris; he would 
be tasked with providing A1 Qaeda with more information on how this attack could take 
place. As Paris gathered information he was to inform members in A1 Qaeda of his 
progress through coded language. 

The command and control for Operation Bojinka seems to also most closely 

resemble Mintzberg’s Machine Bureaucracy with significant hierarchal controls. 

However, the lower-level agents in the organization were empowered to test some of the 

technology to be used in the plot (i.e., bombs on aircraft). The plot itself was highly 

complex, indicated that in order to be successful, some type of divisionalized form would 
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have been necessary for plot execution. One part of the organization, for example, could 
focus on placing explosives on aircraft; a second would focus upon placing an explosive 
device at the U.S. embassy, and a third could focus on attempting to assassinate the Pope. 
Strong lateral communications and hierarchal leadership would be necessary if resources 
were to be shared among all the sections, as well as to ensure that the attacks occurred 
simultaneously for maximize effect. Operation Bojinka moved to the next phase in 
August of 1994 by members of leadership within the terrorist hierarchy including KSM 
and Ramzi Yousef. The plot was thought to be finalized after Corder’s failed attempt to 
attack the White House with a small airplane in September of 1994. With this last change 
implemented and funding through Bin Laden and KSM finalized, the brainstorming 
concluded and active planning began by bringing on more members with expertise in 
different areas, a cell was formed. One man that was brought into the cell was a 
childhood friend of Ramzi Yousef named Abdul Hakim Murad, also a pilot trained in the 
United States. All other cell members were told to meet in Manila by a given date to 
begin planning. 

The decision to move forward with the concept is a very important part of the 
terror cells evolutionary progress. During this phase the cell is moving from just an idea 
to action. According to an official within the FBI, most cells do not move past plot 
conception. “A lot of these guys lose the jihadi, desert spirit,” said the official. “They get 
families, they get jobs, and they lose the fire in the belly. Welcome to America.” 
(Klaidman, 2003). Many of these cells start because they would like to imagine a place 
where change and greater things can be a reality. In order to move beyond talking about 
change to making change they will need to undertake a crucial period of development 
within a terrorist cell. So what is the major change between talking about horrific ideas to 
actually performing those actions? 

1. Catalyst for Progression 

Moving a cell from internally harboring resentment to actively pursuing violent 
means as a solution to their problems usually involves an outside catalyst, available in a 
variety of forms. There could have been a recent failed or successful terrorist attack. Fred 
Burton (The Lessons of the Library Tower Plot, 2007) gives many examples of this type 
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of catalyst. Another cause for the transformation is a charismatic leader or recruiter 
strongly encouraging the cell to move forward. Recruitment in terms of this paper refers 
to not only convincing an individual to join in a group but ultimately inciting action that 
furthers the goals of the organization. In terms of terror cells discovered in the United 
States specific people will be brought in to ‘close the deal’ in their recruitment. This type 
of recruitment relies “heavily on personal appeals tailored specifically for a targeted 
individual or small group. They often use peers, including relatives, in making the pitch. 
This strategy effectively leverages the influential power of conformity (peer pressure) 
and related phenomena... the power of one-on-one persuasive communication is brought 
to bear at an individual level, and new recruits can be directly manipulated” (Gerwehr 
and Daly, 2006, p.83). These recruiters would convince the potential new members 
through rhetorical argument that the only solution to Muslim suffering is actionable 
violence. 

The first catalyst discussed above that will motivate new members of a cell 
towards violent action is the presence of an outside catalyst such as a recent successful or 
failed terrorist attack. Martha Crenshaw (Theories of Terrorism, 1988, p.l4) documents a 
number of catalysts that could produce the extra incentive for a group to move towards 
executing their idea. “Such an opportunity could stem from the vulnerability and 
availability of symbolic targets...In turn a prior incentive or ideological direction may 
lead to a search for opportunity, which determines and risk-prone groups may be adept at 
creating”. Counterterrorism specialists must be sure to analyze the group they suspect 
independent of other terrorist groups, being aware that certain groups may not be looking 
to hit a new unforeseen target. Certain groups will use past successes and failures as 
catalyst for their own attacks. 

Whatever belief systems or rhetoric these spiritual leaders had at their disposal 
they would use to convince new members to switch from being sympathetic towards their 
Muslim brothers in the Middle East and abroad to being outraged at everything that is 
happening in the world today. As soon as the leaders could get them to this stage it was 
very easy to move them to the next phase in the cell lifecycle: decision to move forward 
with conception. 
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Post (2002, p.l05) provides a list of observable indicators of risk associated with 
a cell that might have a charismatic leader-follower relationship: 

1. The group is consumed by a sense of millenarian [end of a millennium] 
urgency. 

2. The followers uncritically follow the leader’s directive. 

3. The group has charismatic characteristics and the leader has a history of 
violence or believes that violence is necessary in the pursuit of the leader’s 
goals. 

In conclusion some things that counterterrorism authorities should look for in this 
stage are first and foremost the formation of an operational cell. This means watch for 
changing trends in local groups through their membership intake or regular publications. 
If a group is transitioning into violent extremism, it can be assumed that they will need to 
change their recruiting style. Leaders of the cell will look for individuals that can be 
trusted. Additionally, they will take their recruitment underground. For example Yousef 
contacted childhood friend, Murad, to help. lyman Paris was brought to Afghanistan to be 
tasked with researching further information an addition to the original cell that conceived 
the plan. 

In order for the plan to move from conception to acquiring resources there needs 
to be a meeting and, at least in all cases studied in this paper, have taken place in person. 
That means that there is a point in the evolutionary cycle of a plot that all parties are 
present to decide the fate of their idea. The September 11 mastermind, KSM, met with 
Osama Bin Laden in 1996 to propose the idea of using airplanes as missiles on targets 
and although Bin Laden liked the idea he was not convinced to fully support it. By 1999, 
Bin Laden called KSM back to Afghanistan and told him that his idea would be fully 
supported by A1 Qaeda (National Commission on Terrorism Attacks, 2004, p.2). This 
meeting took place in person because it was such a significant step in the evolutionary 
process. 
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IV. PHASE II - ACQUIRE RESOURCES 


The next phase in the evolution of a plot is the period spent acquiring resources 
and information on the agreed plan. This is the period of time when the terror cell is 
planning the exact details of how the attack will be carried out. Each step in the execution 
of the plot is carefully scrutinized and resources that are needed to carry out each step is 
acquired. For this phase of planning, the individuals involved will need to be relatively 
close to their target for research purposes; they will also need to be as inconspicuous as 
possible. However, for counterterrorism authorities this is also the most observable part 
of the plot since most resources are acquired and those that are not physically obtained 
are thoroughly researched. 

A. INITIAL ACTIVITIES 

The general timeline for this phase varies from plot to plot but generally lasted 
from a few months to less than one year in duration. For the Millennial Bombing, Ressam 
began initial resource gathering in early summer of 1999 and concluded around late 
October making it a total of six months devoted to this phase. Fikewise, the 9-11 
conspirators were formed in early 1999 and by the fall of that same year were already 
completing extensive training and research on their target (National Commission on 
Terrorism Attacks, 2004, p.2). Faris took much more time to reach the same point as 
Ressam; Faris began his research in April 2002 and concluded in March 2003. However, 
Fans also had much more difficulty in acquiring resources for his plot and ultimately 
concluded that execution would be unsuccessful. Finally, Operation Bojinka found that 
they could conclude resource acquisition in only three months from September to 
November of 1994. 

In the previous phase, decision to move forward with conception, the cell will take 
on field experts in whatever subject area they may need. These individuals, along with 
the original cell, will be the constituents throughout the resource phase as well. However, 
it should be noted that in Ressam’s testimony he told the court that at the training 
sessions in Afghanistan he was instructed that as part of typical cell operations, each 
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member of the cell is to keep their portion of the plan a secret from other members 
(Ollen, July 3, 2001, p.551-2). The only reason to share information is in the event that 
one cell member is required to collaborate with another for plot execution. Thus the plot 
will not necessarily have a single point of failure as it did in plot conception since 
members are now acting somewhat independently of one another; it will also not be 
entirely evident who holds what portion in plot execution. As J. D. Farley (2003, p.400) 
stated in Breaking Al Qaeda Cells: A Mathematical Analysis “It is not enough simply to 
seek to disconnect terrorist networks. For although doing so may succeed in creating two 
clusters of terrorists incapable of communicating directly with each other, one of the 
clusters may yet contain a leader and enough followers to carry out a devastating attack.” 
This statement is verified through plot analysis of the 9-11 conspiracy. KSM’s original 
pilots Hazmi and Mihdhar did not follow through with the original plan, which was to 
travel to the U.S. and train to become pilots of commercial airliners. “This failure, 
however, had little impact on the plot. The setback occurred early enough to permit 
further adjustment. Al Qaeda’s discovery of new operatives—men with English language 
skills, higher education, exposure to the West, and, in the case of Hani Hanjour, prior 
flight training—soon remedied the problem” (National Commission on Terrorism 
Attacks, 2004, p.l4). 

The acquiring resource phase will have a variety of activities taking place as it 
progresses. Within the first few months of the 9-11 plot conspirators were learning “basic 
English words and phrases” (National Commission on Terrorism Attacks, 2004, p.2). In 
addition, the cells leadership had “showed them how to read a phone book, make travel 
reservations, use the Internet, and encode communications. They also used flight 
simulator computer games and analyzed airline schedules to figure out flights that would 
be in the air at the same time” (National Commission on Terrorism Attacks, 2004, p.2). 
The cell will need to integrate into their surroundings while also still preparing for the 
main objectives. 

The cell will also want to ensure that it can operate seamlessly in their new 
environment. As Ressam stated in his testimony, the first step in acquiring resources for 
the plot is to establish an identity (Ollen, July 3, 2001, p.572-3) and a work location. This 
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is to ensure fluid movement within the country while also remaining anonymous in 
action. Ideally they would want to be legal in the country but it is not necessary. Ressam 
was wanted by immigration while in Montreal working for Haouari, but immigration 
never found him before he was ready to execute his plot in the United States. Likewise, 
lyman Paris had come to the United States under a student visa but never enrolled in a 
school, a violation of U.S. student visa statutes as well. The cell will generally establish a 
base of operation; for Ressam, the base was located in Montreal and Vancouver. Yousef 
based his operation out of Manila, and Paris had to return to the United States where he 
was able to use his truck driving career as mode to travel to his area of research. 

B. SURVEILLANCE AND TRAINING AS CELL TACTICS 

Once this base has been established, the next step is to begin surveillance of the 
target(s) and to acquire resources inconspicuously; this can be considered the most 
observable portion of a terror cells lifecycle. Por example, lyman Paris took a detour on 
his truck route to travel to the Brooklyn Bridge to observe security and surveillance 
precautions enacted at the site. Purthermore, Yousef and Murad rented an apartment up 
the street from the U.S. Embassy target in Manila and would also be the route taken by 
the Pope on his visit to this Southeast Asia city. Por Ressam, surveillance would not be 
necessary since in the plot conception he had already concluded that security was lax 
enough to provide success for the plot. He would be able to figure out an exact location 
of his bomb simply through a test execution. Thus counterterrorism authorities should be 
aware that for soft targets, terror cells may be able to bypass this step entirely since it is 
not always necessary for their success. 

Additionally, during this phase, members of the cell will want to consult their 
field experts for information on acquiring certain resources necessary for plot success. In 
the Millennial Bombing, Ressam contacted an associate on how to acquire a firearm with 
a silencer. Ressam also worked with Dahoumane to obtain highly explosive chemicals in 
Vancouver and used him as a resource for bomb construction. Paris consulted an 
acquaintance for ways to get a hold of something that would cut through the supports to 
the Brooklyn Bridge. 
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“Even groups who recruit, select, and socialize former military personnel still 
must prepare and train for specific operations, with reference to their specific roles and 
assignments” (Post et ah, 2002, p.92). In the absence of field experts, cell members must 
use their own means to acquire and learn about a certain subject matter. This is highly 
beneficial to counterterrorism specialists since lack of expertise often presents a scenario 
where additional training or as a result accidents are much more likely. “Groups that are 
more likely to pursue terrorism provide members with training designed to promote 
military discipline and coordinated group action against opponents. Members must be 
trained to use weapons, follow directions, and must be prepared for the intensity of 
violent conflict” (Post et ah, 2002, p.92). 

Ressam was not familiar with marksmanship and thus had to acquire a silencer 
with his gun in order to practice without causing alarm. Yousef and Murad had not 
worked with explosives before and were forced to create and test such items within the 
confines of their apartment through the only means they had available: trial and error. 
Furthermore, Yousef had to train individuals to assist him with his plan to assassinate the 
Pope. “While in the Philippines, Yousef traveled to the Abu Sayyaf base in Basilan and 
trained about 20 members in 1994. A year later, he gathered about 20 men in 
Matabungkay, near the capital, Manila, and trained them allegedly to help assassinate the 
Pope” (Ressa, 2001). 

This is also seen in recent cells such as the Northern Virginia Jihad Group who 
tried to train at a local paintball facility. Likewise the Portland Seven practiced target 
shooting, paramilitary tactics and martial arts at various inconspicuous locations in 
Oregon (McNulty, 2006). In the absence of a real training or research facility, cell 
members are forced to adapt to their environment. As such they will use whatever is 
available to them such as back-wooded areas that are quiet and undisturbed or a paintball 
facility where they train as if they are in a real wartime environment. Knowing this, 
counterterrorism specialists must look at each situation in an analytical way with 
counterterrorism always in the back of their minds. 
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C. COMMUNICATION METHODS 

Communication during the acquiring resources phase is frequent in the beginning 
but as members get further into this phase and begin to transition to the next stage, 
communication will begin to wane. Ressam used a pay phone or a pay-as-you-go cell 
phone to complete all remote conversations with Doha, Meskini or Dahoumane. 
Additionally, if he were to speak in person with someone he would often use Arabic so 
that he would not be easily understood by bystanders. In the beginning of the plot, 
Ressam would talk to Doha to work out details on how he (Ressam) was to execute this 
plot without the entire cell. Once Ressam moved past those larger details, he no longer 
needed to check in with Doha as often. However, Ressam did need to discuss his trips to 
Vancouver with Dahoumane and near the time of execution, he began discussions with 
Meskini. 

Paris also used a coded language to transmit messages back to Afghanistan. This 
plot, planned nearly eight years later, used email as a medium but the guiding principle 
remained the same: secrecy is paramount. Paris was told to transmit messages through 
another individual located in the United States, then that individual would forward it on 
to Afghanistan. Purthermore, Paris was instructed to never immediately access his email 
when signing onto the internet, but rather to go to at least one other website first. As for 
the content of his messages, he was told to refer to the metal cutting tool that would be 
used to cut through the support cables of the bridge as gas stations and the train 
derailment tools as mechanic shops. Thus counterterrorism specialists must be aware that 
certain words are not being used in the right context even if that specific word would be 
considered normal for a truck driver to use. 

It should be noted that the Brooklyn Bridge attack did not progress beyond this 
point. Paris experienced a lot of trouble finding out information about the tools needed to 
complete the task. He was also very skeptical about the plan’s success due to the extra 
security measures present at the bridge. Ultimately, he sent a message back to 
Afghanistan the said “the weather is too hot” which meant that Paris did not see the plot 
as being successful given the circumstances. It should be understood though that a large 
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reason that the plot did not move forward was because of perceived security measures by 
lyman Paris. This sense of added security would eventually cause Ressam’s plot to fail as 
well since he tried to flee when border patrol questioned him further at the security gate. 

D. INDICATORS OF TERRORIST ACTIVITY 

There will also be physical items to be observant of when looking for a terrorist 
cell; however, depending on when the proposed execution of the plot will be, will 
determine what items will be acquired. A terror cell will wait as long as possible to 
acquire resources that are easier to track or that can only be acquired through illegal 
means. Thus in the beginning of this phase they may purchase things like circuitry or 
timers (a wristwatch) for the bomb in addition to large amounts of batteries or hydrogen 
peroxide for explosives. However, the other more explosive chemicals will only be 
researched by the cell on how to acquire until the date of attack becomes more imminent. 
Examples of explosive substances that would be bought or acquired at a later date 
including nitroglycerin, nitrate, sulfuric acid, nitrobenzene, silver azide, or liquid acetone. 
Each of these substances is highly explosive and thus, when bought in large quantity, 
may cause suspicion. As a result, the cell will wait as long as possible before purchasing 
anything of this nature. 

Conversely the cell may opt for Ressam’s method. He purchased unsuspicious 
amounts of urea and aluminum sulfate from garden shops while visiting Vancouver in 
month of November. Both of theses substances can manipulated into highly explosive 
materials over an extended period of time. This tactic although much harder to track can 
raise suspicion especially considering that he was frequenting garden shops in the middle 
of November in Vancouver, Canada. 

The only exception to this may be if they can acquire what they need through a 
third source illegally and without causing any alarm. Ressam did this by contacting a 
friend to obtain a gun with a silencer. In addition to the gun, Ressam also needed to 
acquire nitroglycerin which he could not acquire legally. He waited as long as he could to 
steal it from a farm fertilizer factory in Vancouver with the help of Dahoumane. The 
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disappearance of such a chemical should raise suspicion for counterterrorism specialists, 
especially due to the high volatility of this chemical. 

In Operation Bojinka, the acquisition of explosive chemicals needed to be 
expedited since Yousef and Murad did not know how to make a bomb; they were forced 
to practice within the confines of their apartment. Ultimately this is how their plot was 
discovered — the bomb they were creating in their apartment accidentally exploded and 
the fire department was contacted to put the flame out. A chemical fire in a local 
apartment raised police suspicion and the plot was discovered soon after the police 
started to investigate the apartment a little further (Department of Transportation, 
Security of Checked Bags, 1999). 

E. TRANSITIONS IN LEADERSHIP 

As a result of this phase of the planning there will be a transition from the original 
hierarchy of the leaders, the original concept holders and financers, to the cell now taking 
charge of its own affairs. As the cell moves closer to execution, the terror cell’s 
leadership will become much more distant in decision making and financial matters. “A1 
Qaeda requires terrorist cells to be self-managed and often self-sufficient when it comes 
to finances...This keeps A1 Qaeda’s financial sources as discreet as possible while 
allowing operational cells to deploy without ever giving away information on A1 Qaeda’s 
underlying financial network” (Basile, 2004, p.171). We see this in each of the examples 
provided: Ressam began his initial planning with Doha in order to work out whether or 
not he could move forward with the plot without the rest of his team. By the time he is 
ready to go back to Vancouver to build the bomb and then start to travel south into the 
United States he is adding members to his cell (Meskini) and is now tasking Doha with 
obtaining items such as identification and passports. 

lyman Fans never reached the end of this phase, thus we only observe his role as 
researcher. By the time the FBI picked him up was still only transmitting reports back to 
Afghanistan on his progress. Yousef, in the beginning, was working with his financiers to 
ensure that his plot would be funded, but as soon as he had the funds began working 
entirely on his own with the cell he created. The quick transition for Ahmed Yousef could 
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be attributed to his comfort level in executing these plots; after all, he had just completed 
the initial World Trade Center bombing a little over a year earlier. 

Thus the cell as it enters the next phase — decision to execute — will be a largely 
autonomous cell not requiring the same communication levels as needed in the 
beginning. However, where remote communication is weak, planning activity will 
increase exponentially. The cell will begin by acquiring its non-traceable items and then 
as they move closer to execution they will acquire the more volatile and dangerous 
resources that are more traceable. 

Once a cell has acquired all the resources and has worked out a detailed plan to 
execute those resources, they will be ready to move into the next phase. While lyman 
Fans never reached this point, Ressam and Yousef were able to advance their plot to the 
point where they were ready to execute. This next phase, albeit short, is crucial; this is the 
period in the phase where counterterrorism specialists have their last opportunity to stop 
the progression of the plot; once the plot reaches its execution phase chances of stopping 
the plot decrease substantially. 

F. DECISION TO EXECUTE 

The decision to execute is another transitional phase like decision to move 
forward with concept that will have a discussion or series of discussions where the cell 
will reevaluate their progress and choose a course for execution. However, once this 
second meeting takes place, communication with the cell’s hierarchy will no longer be 
needed. Thus, as a result of this meeting the cell becomes entirely autonomous. This is 
due to the fact that the last meetings take place to ensure that they can receive any last 
minute funding and then the cell’s only purpose is to execute, they will not need to 
communicate with their leadership for that. 

I. Initial Activities 

Ressam contacted Doha to receive some last-minute identification that would get 
him over the border into the United States. Ressam then contacted Haouari to ask for 
money to help him purchase his last few resources. Haouari agreed and within two weeks 
Ressam had everything needed to finish planning the execution of his plot. lyman Paris 
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also contacted the individuals in charge of his plot, unlike Ressam, Paris was contacting 
them to inform them of his decision not to move forward with the plot. Finally Yousef 
and Khalif were supposedly often meeting to discuss financial details about the plot. 

Another crucial element in this phase is that cell members will acquire many of 
the traceable items avoided in earlier phases. This will also be the period of time when 
test runs will take place. The reason for waiting so long is that these activities are the 
most observable. Thus, the cell waits as long as possible to perform any actions that may 
jeopardize the success of their plot until it is absolutely necessary to perform these 
actions. 

The Millennial Bombing was to take place on December 31, 1999. Ressam waited 
until November before flying back to Vancouver with cash from Haouari to finish out 
details for his (Ressam’s) plot. He met up with Dahoumane to purchase the last of the 
urea and to steal explosive material from the fertilizer factory. While in Vancouver, he 
spent two weeks preparing the explosives with the stolen chemicals. Each of these 
activities had a certain amount of risk associated with it. Thus, it was ideal for Ressam to 
wait until the attack was nearly ready to be executed to complete those tasks. 

Yousef used the same tactic in completing readiness for his plot. He and Murad 
ensured that they had all the correct resources to complete their plan, but waited until 
very close to the proposed date of execution to run their test plans. Shah tested the 
effectiveness of using a bomb under a seat by placing an explosive device in a local 
Manila theater to detonate at a given time. Additionally, Yousef tested airport security by 
taking a contact lens bottles through security with a clear liquid that would be 
nitroglycerin on the day of execution. He also wore extra jewelry to confuse the sensors 
so that he could put the fuse in his shoe without detection. Once he moved the pieces of 
the bomb through security, he was able to assemble the explosive in the bathroom of the 
in transit airplane and ultimately leave it under the seat of a passenger to detonate at a 
later predetermined time. Ressam, had he made it to Los Angeles, would have used a 
very similar approach to determine where to place his suitcase bomb most effectively. He 
had wanted to take an empty suitcase and place it in different locations around the 
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terminal to see how long it would take to be deteeted. The aetual suitease bomb would be 
plaeed and timed aeeording to the outeome of these test runs. 

These test executions are crucial to helping counterterrorism specialists realize 
that something bigger may be imminent. Every terror plot, although it may be based on a 
previously tested idea, is new for each situation and environment in which it is being 
executed. Thus it must be tested for validity in a successful execution. In the 9-11 plot, 
each pilot before the actual event “flew first class, in the same type of aircraft he would 
pilot on September 11.” From this reconnaissance, the terrorists determined “that the best 
time to storm the cockpit would be about 10-15 minutes after takeoff, when they noticed 
that cockpit doors were typically opened for the first time” (National Commission on 
Terrorism Attacks, 2004, p.9-10). 

The almost certain conclusion that one can draw about a plot that reaches this 
phase is that it will progress directly into the final stage of the evolutionary cycle: 
execution of the terror plot. There is no outside catalyst that needs to take place to make a 
transition to the execution phase. 
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V. PHASE III - EXECUTION 


Although none of the case studies analyzed achieve this final phase, each was 
imminently approaching this end. This stage is the culmination of all the other stages. At 
this point the cell reestablishes its base to the location of attack (if not already there), and 
will execute what has been thoroughly rehearsed and tested. For the 9-11 conspirators 

The last step was to travel to the departure points for the attacks. The 
operatives for American Airlines Flight 77... gathered in Laurel, 
Maryland, about 20 miles from Washington, DC. The Flight 77 team 
stayed at a motel in Laurel during the first week of September and spent 
time working out at a nearby gym. On the final night before the attacks, 
they stayed at a hotel in Herndon, Virginia, close to Dulles Airport. 

Further north, the operatives for United Airlines Flight 93... gathered in 
Newark. Just after midnight on September 9, Jarrah received this speeding 
ticket as he headed north through Maryland along Interstate 95, towards 
his team’s staging point in New Jersey (National Commission on 
Terrorism Attacks, 2004, p.lO). 

Once a cell has reached this stage, they are in place and ready to attack. Failures 
are limited to logistical problems or due to suspicion they are detected during the 
attempted attack - a role that falls predominantly on law enforcement and security 
personnel. As it stands now police are already overworked and undermanned. Brian 
.Jenkins in his Remarks Before the National Commission on the Terrorist Attacks Upon 
the United States (2003, p.8) suggests one way of preparing ourselves for terrorist attacks 
would be to build “more effective local-level intelligence-collection” since “we have 
great potential at a local level”. This is due to a variety of reasons: “local police know 
their territory. Recruited locally, their composition better reflects local 
populations... more native-fluency foreign-language speakers... [and] they don’t rotate to 
a different town every few years” (Jenkins, 2003, p.8). .Jenkins goes on to explain that 
New York and Los Angeles Police Departments have implemented intelligence agencies 
into their units. 

New York has created an intelligence gathering and analysis department. 
Likewise Los Angeles has created departments that come together with federal 
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intelligence communities to share and exchange vital security information. However, in 
order to enforce something similar to these profiles nationwide there needs to be support 
at a federal level by way of “training, common curriculum, and technology...And then 
they need to be linked do that information could be quickly transmitted across the 
network” (Jenkins, 2003, p.8). .Jenkins (2003, p.8) explains further that many U.S. 
corporations are already doing this, so the infrastructure is already in use, it simply needs 
to be implemented now. There are a myriad of advantages to implementing a system like 
this. First, there will be a nationally supported intelligence community that will be linked, 
working together for a common goal. Secondly, this will intelligence community will 
have arrest power, so the intelligence they collect is immediately actionable. 
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VI. GENERALIZED MODEL 


By synthesizing these three case studies and illustrating where patterns have 
emerged, the following model gives an overview of what those patterns produce in the 
evolution of a terror cell. Organizational contingency theory, deriving from open systems 
theory, suggests that regardless of size, orientation or mission, terrorist organizations 
operate within the confines of their environments and resources. Combined with Charles 
Tilly’s (2006) observations about repertories of contention, it follows that the feasible 
space of terrorist organizations’ actions and behaviors is bounded, and selection of tactics 
limited. There seems to be reoccurring evidence that terrorist organizations tend to plan 
simultaneous and large-scale attacks with most attacks being based on previously 
successful attacks. This is advantageous because it means more evidence and cues to look 
for. “Killing as many as possible seems to have been the paramount criterion in most of 
the plans” (Jenkins, 2006, p.l85), “although many of the schemes appear to be drawn 
from the same playbooks as the terrorist attacks that did occur” (Jenkins, 2006, p.203). In 
the following pages this paper suggests that a plot can be broken down by phases based in 
environmental cues, the same cues that can be used by law enforcement and 
counterterrorism authorities to combat terrorist infiltration. 
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Figure 1 . Conception of Generalized Model of Terrorist Attack Planning 
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A. CONCEPTION 

The general timeline for the conception of a plot varies. It will also be dependent 
on a myriad of factors including who cell consists of and the target. However, we can 
generalize idea conception to be from one of two sources, bottom-up or top down. In 
terms of this paper, an idea that bottom up conception exists when a member of a cell or 
an independent member creates an idea initially and then has it approved by a leadership. 
The Millennial Bombing is an example of this type of plot. Conversely a plot that is top 
down is conceived by leadership of an organization and then delegated to cell members to 
execute. The plot to destroy the Brooklyn Bridge is an example of a top down plot 
conception. 

During this phase there will be one or more meetings that are usually private and 
led by a leadership figure. These meetings can take place within the U.S. or abroad, 
especially at training camps where brainstorming is highly encouraged. From this 
brainstorming, regardless of source, a rough idea or plot will emerge. There is nothing 
concrete, just a series of ideas that may or may not be recorded. 

There will also be an easily identifiable leader since the cell has not been 
solidified and members have not committed yet. As such, there are a number of 
identifiers to cue such a group is being established. This is one of the few times in the 
lifecycle of a terror plot that the terrorist organization will have to reach out beyond the 
edges of their group to find members that will help their plot thus making themselves 
visible to counterterrorism specialists. However, the cell only become visible if one 
knows what to look for. 

Indicators that subversive recruitment is taking place could be observed in the 
transformation of a group’s outgoing communications via pamphlets or brochures. A 
group that is transforming from a discussion based organization to one that is advocating 
a more violent or radical viewpoint, is also indicative of subversive activity. Another 
indicator is the transition of an open group moving towards much more closed and 
secretive gathering. Often when this happens, large attrition rates and screenings will 
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take place within the group thus one will also see a transition in acceptable criteria to 
become a member of the group (Post et al., 2002, p.90). 

This is the ideal time for counterterrorism specialists stop terrorist planners since 
it is the weakest point in the lifecycle of the cells progression, there is a single point of 
failure present in the recruiter or leader of the cell. New members of the cell have not 
committed to the plan yet and are still not as dedicated as the leader / recruiter. Also 
realize there is a tendency by Al Qaeda terror cells to think on a grandeur scale and thus 
the lack of moderation can be a source of breakdown. The more individuals that need to 
be brought into a cell’s planning means the larger probability of its detection. Finally, 
counterterrorism specialists need to be aware of the growing connection between 
terrorism and crime; more and more illegal means are being used to fund terrorist 
activity. 

B. DECISION TO MOVE FORWARD WITH CONCEPT 

This phase is crucial in the development of a terror cell, but will not take very 
long to conclude. It only consists of a meeting or set of meetings that at least in this 
analysis have taken place in person. There will be very specific people involved with this 
phase including, whoever the financer (or future financer) of the plan will be, plotters or 
cell members, and the leadership or management. In some cases one individual may 
represent multiple roles present in this meeting. For example the leadership of a cell 
might also be financing their ventures. This meeting will be advanced by a leader to 
move forward, thus there will still be a single point of failure. By neutralizing the agitator 
(the individual pushing a decision) or by stopping the financing, all plans must be called 
off or at the very least postponed. 

Additionally, this push for a decision can come as a result of many factors 
including a charismatic leader or a recent terror plot’s success or failure. The most 
important result of this phase is the general consensus by all members to move forward. 
At the conclusion of this phase and the onset of the next represents an excellent point of 
infiltration for counterterrorism specialists, as the terror cell will be looking for field 
experts in certain areas to help execute the plot. 
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C. ACQUIRE RESOURCES 


This period of cell development does not have an exact length although its 
beginning and end are specifically defined. The beginning is defined as the point 
brainstorming concludes and the cell concedes on one plot. It ends when the cell decides 
all resources are acquired and preparations are complete. 

One advantage that counterterrorism specialists have is that this part of the cell 
lifecycle is the most observable. The cell will concentrate its energies on preparing 
specifically for the execution of the plot. Time is spent predominantly on acquiring 
resources, people and skill sets necessary to execute the plan. Additionally, the cell will 
spend a significant amount of time surveying their target; as such the terror cell will need 
to move to the location of execution. As such it is hard to pinpoint an exact amount of 
time needed for this phase. That is dependent on the plot and the amount of preparation 
needed to execute the plan. However, no matter how much resource gathering or 
surveying is accomplished, the cells primary goal will be to remain as inconspicuous as 
possible. The terror cell will be continually trying to assimilate themselves into the 
population. 

There has also been a transition in cell structure by this phase; the focus will be on 
the terror cell specifically versus management or financers. As a result, the command 
structure at this phase can be considered much more horizontal as opposed to hierarchal. 
Generally, each cell member will have a specific role in the plan and will only focus on 
that role. There is less collaboration between cell members unless a certain portion of the 
plan overlaps. It is paramount that cell members keep their own secrets in order to 
preserve the integrity of the plot. There may be residual communication between 
management and cell but it will be minimized and often presented in coded language so 
as to avoid detection. 

The cell will acquire non-suspicious resources like piping or timers during the 
acquire resources phase. Even though they will not purchase traceable items like 
explosives, they will at the very least research when and where to buy those items. 
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Additionally, they will improve their skills such as tactical military training or learning 
how to fly a plane in the example of the September 11 attackers. 

D. DECISION TO EXECUTE 

If a terror cell progresses to this phase their chances of actual execution is very 
high. Furthermore, their success is strongly linked to the efficiency with which they can 
execute their own carefully crafted and rehearsed plans. This phase, like the decision to 
move forward with concept, is very short, and also quite critical. Once again the cell must 
agree that they have thoroughly planned and trained and are ready to move forward with 
the last portion of their plan: execution. 

In terms of command and control, the cell will momentarily return to a hierarchal 
structure before returning back to an asymmetric control structure. There will be contact 
with the cell leadership and financing to ensure that the group’s leadership still wants the 
plan to proceed. Additionally, there will often be an exchange of money for any last 
resources — specifically those resources that are considered most vulnerable to detection 
by law enforcement, security, intelligence, or counterterrorism personnel. They want to 
wait as long as possible to acquire these items to give counterterrorism authorities the 
least amount of time to respond to any alerts. 

During this phase, there will also be test executions. For example, in Operation 
Bojinka there was a minor explosion on an airliner to test security. Other common tests 
are to leave bags or vehicles unattended with nothing in them just to see how long it takes 
someone to notice. 

An interesting aspect to this phase is that once the cell has received approval from 
their leadership, all communication with those individuals is severed. The cell is now 
acting as an independent group and will carry out the rest of the plan without external 
input. Thus when the cell has acquired their last minute resources like explosives and feel 
satisfied that test executions (if there are any) are acceptable, they will gravitate directly 
into the execution phase. 
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E. EXECUTION 


The final phase is completed within weeks of the conclusion of decision to 
execute and as stated earlier will have no observable communications external to the 
execution cell. At this point the cell can be treated as well trained separate entities each 
completing their portion of the plot within the parameters decided upon during earlier 
phases. This phase can be likened to a well-oiled machine; there is no need for discussion 
or preparation, only action. Counterterrorism specialists must now rely on preventative 
security measures already in place to stop terrorist attacks. 
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VII. IMPLICATIONS FOR THE FUTURE 


The 2006, Uniting Against Terrorism Conference proposed a broad solution to 
combating terrorism, presented in a compact list: 

• Denying access to financial support 

• Denying access to weapons 

• Denying access to recruits and communications by stopping internet use 

• Denying access to terrorist travel 

• Denying access to terrorist intended targets 

It may seem rather simple to state this list since there are so many things that terror cells 
can do to combat our attempts to deny access. Before the 9/11 attacks, the United States 
had terrorists entering our borders from other countries; today a rising concern is the 
possibility of homegrown, self-directed terror cells. Homegrown cells have an advantage 
in that they typically do not need to rely on false identification to function within the U.S. 
borders. Additionally, terror networks are learning to avoid technology that is traceable 
such as cell phones and email. Finally, it is difficult to follow the financing of terror plots 
since many of these cells are becoming self-financed versus money being sent from 
outside sources. However, the reality is that we can control what see and observe, and if a 
counterterrorism authority knows what to look for then they will be much more effective. 

As we move forward in our pursuit of terror cells within and outside the United 
States we are confronted with several major obstacles. The director of the FBI said it 
best, “We don’t know what we don’t know” (Klaidman, 2003). Although some of our 
intelligence communities are able to bring in information, parse it and send it back out at 
incredible speeds so that action can be taken on that information. Other agencies like the 
FBI are not set up as efficiently and thus there is delay in response time between 
receiving intelligences and being able to act on that intelligence. (Suskind, 2006). The 
model presented in the previous chapter was created to reduce the search space for 
domestic organizations. 
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The question now becomes: what are the implications for future counterterrorism 
efforts given this model and the patterns gleaned from the three case studies used in this 
paper? The following details observables for counterterrorism specialists for each stage 
of the model. 

A. PHASE I: CONCEPTION 

From these three cases, observables for which counterterrorism personnel should 
focus on primarily are that terrorist’s tend to recruit and plan in areas where they feel 
comfortable and safe. This will be especially true if that area has community members 
supporting their ideas such as areas where social conformity and trust between 
community members is very high. Counterterrorism personnel will need to be mindful of 
areas where terror cells or sympathizers have been located in the past or where known 
extreme ideological groups reside. Additionally, counterterrorism authorities will want to 
monitor for a group that changes from discussion-based to becoming increasingly 
extreme in their solutions to discrepancies. This type of transformation is a strong risk 
indicator for counterterrorism authorities to take notice of. 

Additionally, “Moderation frequently has been the element that has made the 
difference between success and failure for A1 Qaeda operations” (Burton, The U.K. Plot, 
2006). The goal behind organizing and executing terrorist activity is to achieve a level of 
fear among their targets, thus terror cells will want to make a statement, and so the 
probability of going big is higher (Burton, The U.K. Plot, 2006). This is ideal for 
counterterrorism specialists since they can use this fact to their advantage. “With every 
person who is brought in on a secret, the risks of detection or infiltration of a cell 
increase. Given the large number of arrests that have been made in the U.K. case, and the 
fact that authorities believe as many as 50 people perhaps were involved in the plot, it is 
not surprising that operational security was compromised” (Burton, The U.K. Plot, 2006). 
Also with an expected increase in homegrown terrorism there will not be the same 
precision and experience of having A1 Qaeda leaders providing guidance and lessons 
learned. 
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In all three cases, there was a leader guiding the discussion. “An effective identity 
entrepreneur can create identity where none exists, or can magnify identity in such a 
manner as to create nostalgia for a greatness or stature that may have never existed, or 
can manipulate or distort identity to a point of convincing his audience that their identity 
is synonymous with victimhood, injustice, and discrimination” (Thomas, Kiser and 
Casebeer, 2005, p.86). The terror cells that have been recently discovered in the United 
States, including the Virginia Jihad Group and the Portland Seven, the leader is generally 
a recruiter (McNulty, 2006). Thus they have been trained to gain the trust of members so 
that members will brainstorm openly. 

Given this ambiguity, there is one encouraging aspect: a plot in its infancy of 
conception generally has a single point of failure, especially for homegrown terror cells 
that are not directly connected with a terrorist organization. This is because for a 
homegrown terror cell there is usually one person (or at least a minimal number of 
people) guiding the discussion at this phase. The final cell that will execute the plot has 
not been created and members have not bought into the idea yet. The leader of this group, 
usually a leader within a mosque or religious center, will hold offsite meetings to 
brainstorm and encourage members to commit themselves to furthering Islam. 

A change in the pattern of the radioalization process and that those 
responsible for the change are taking extra precautions, including 
appearance in limited circles in marginalized Islamic activity or Islamic 
centers such as: home gatherings, country clubs, libraries, and schools. 

This pattern of activity is quite difficult to detect when dealing with a 
limited cell, although it is evident that the leader of a terror cell will search 
for his potential recruits in this type of environment (Azani, 2006). 

These cells are aware that they are being watched and are taking the extra 
precautions necessary to ensure that they are successful. 

There are number of additional items that counterterrorism specialists should be 
aware of as indicators to terrorist activity in this phase. First, most cells are now 
establishing their own means to finance plots. According to authors of Warlords Rising , 
terrorist “almost always raise funds through illegal means” (Thomas, Kiser and Casebeer, 
2005, p.83). Illegal means are the easiest way to do this. For example “it has been 
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established that the attacks” carried out in Madrid Spain in 2004 “were financed largely 
by money from drugs trafficking in North Morocco” (Jordan, 2005, p.l75). In the 
Millennial Bombing, Ressam’s cell was a group of poor Algerian robbers who worked 
for a man to steal from the tourists of Montreal. Additionally in Los Angeles there was a 
raid of car burglary fraud that was discovered to be financing Chechen Terrorist activity 
in the Republic of Georgia (Block, 2007). “This case was a breakthrough in that what we 
found didn’t look like terrorism: it looked like regular criminal activity but when we 
followed it long enough it developed what we believed [was] a nexus to terrorism” 
(Block, 2007). Thus, one avenue for counterterrorism authorities is to look for areas with 
increased reports of theft of identification, money or computers. Ressam’s cell acquired 
false identifications to use for their own gain, but also stole identifications, social security 
numbers, money and computers from tourists so that he could sell these to fund his plot. 

B. PHASE II: DECISION TO MOVE FORWARD WITH CONCEPTION 

A cell will move to the next stage once active planning of details within the plot 
begins. General finances for the plot will be established such that base expenses will be 
covered and initial research can begin. This is crucial. A cell can not move forward if 
they do not have the money. Ramzi Yousef, the mastermind behind the initial World 
Trade Center Bombing “told his captors that his plan ... might have succeeded if he’d 
had more funding” (Hirschkorn, 2003). In fact, theories suggest that is the reason that 
Yousef chose to operate in the Philippines after his failed attempt at the World Trade 
Center - there was more funding in the Philippines. “The success of this financial 
network created by Bin Laden, intelligence officials believe, was the reason Ramzi 
Yousef chose to operate a cell in the Philippines. ‘He came here [the Philippines] because 
of an existing support network and structure,’ Col. Rodolfo Mendoza tells CNN” (Ressa, 
2001). Ressam was given $25,000 before he returned to Canada and Yousef could not fly 
to Manila before Osama and KSM had approved finances. Like Ressam’s cell, Jose 
Padilla also returned to the U.S. from a variety of Middle Eastern countries with a large 
amount of cash hand-carried on the plane with him. 
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Additionally, new members of the cell will be brought in as field experts for 
certain portions of the plot. This is a very important aspect at this stage since it will be a 
point of infiltration for counterterrorism specialists. After KSM and Bin Laden had their 
meeting in 1999 to move forward with the 9-11 plot “Bin Laden quickly provided KSM 
with four potential suicide operatives” that already had visas to enter the United States 
with (National Commission on Terrorism Attacks, 2004, p.2). Javier Jordan describes a 
diagram that illustrates the layers of a terror cell in terms of circular shells: 



(Jordan, 2005, p.l81) 


Coordinators 

Almost complete dedication 
Senior international contacts 
Ase and education above averages 


Committed 

First level’s trust men / right hand man 


Sympathizers 

Sporadic or informal relationship to the network 
Specific tasks 

Commitment can increase over time 


Outsiders (Not part of the network) 

Common delinquents 

Radical preachers with no operational history 
Can be non-Muslim 


Figure 2. Layers of Terror Cells 


With this diagram Jordan describes operational cell member (the individuals that 
will execute the plot) as levels three and four in the diagram. Thus this diagram shows the 
inherent advantages and disadvantages for terrorist organizations. “An advantage is the 
enormous difficulty security agencies face in infiltrating the center to obtain quality 
preventative intelligence and the contents of the international relations of the network. 
The disadvantage consists in that exterior circles are vulnerable to infiltration and 
detection. From these circles, it is possible to ascertain who inhabits the inner circles, and 
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these could be arrested” (Jordan, 2005, p.l84). According to Jordan this is the reason the 
Madrid cell was dismantled (Jordan, 2005, p.l84). Clearly outlining an advantage for 
counterterrorism specialists since these networks, in order to survive, must keep their 
exterior open. Terrorist organizations “are obliged [to] fulfill: propaganda, recruitment, 
logistical support or terrorist activity preparation” (Jordan, 2005, p.l85) and the only way 
to do this is by allowing their outer shells to be infiltrated by new members. The 
downside of course being that there is still great difficulty in obtaining the initial 
intelligence that would make a counterterrorism specialist suspect terror activity. 

Terrorism is suspected and infiltration possible, one should be aware that there 
will most likely be a process by which trust is built. This could take place through a series 
of conversations between new members and old, such was the case with Ressam and 
Meskini in the Millennial Bombing. Trust could also be established through a series of 
activities that must be completed like when Paris met with A1 Qaeda operatives in 
Afghanistan. Paris was tasked with ordering sleeping bags, extending tickets and 
delivering a bag that contained money and cell phones. 

No matter how trust was established, each plot had new members brought in at 
this stage. In Operation Bojinka, Yousefs friend was contacted since he was an 
American airline pilot and such expertise would be needed in the Bojinka Plot. lyman 
Paris contacted an associate that was familiar with cable cutting torches to help him 
acquire such tools. He established these contacts while keeping in constant 
communications with his original cell which consisted of members in A1 Qaeda 
leadership including KSM and Majid Khan. Pinally, Ressam used Dahoumane as an 
assistant in Vancouver to steal explosives and build the bomb later in the process. 
Ressam also stayed in contact with his original leader from Afghanistan, Abu Doha, as a 
source of information and false identification. 

Additionally, there were a number of similarities that emerged from these plots 

that highlights patterns that exist in the conception phase. Pirst and foremost, the plot 

conception phase is the weakest part of the cell formation. Many cells do not make it past 

this point. If counterterrorism authorities had an ideal time to stop a plot, this would be 

the phase in which to most easily deter progress or apprehend suspects. There is usually a 
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single point of failure since the largest driving force is the leader. This source of 
motivation pushes hedging members to be more confident so that they move forward 
with active planning. The cell is still in its infancy, so individuals are still unsure of 
themselves and their compatriots. Now is the easiest point in time to infiltrate a suspected 
terror cell. Planning at this stage usually takes place in person at a location where cell 
members feel safe and secure. This is to create an environment where frequent meetings 
can exist to support open brainstorming and ultimately decide on goals for the cell. 

C. PHASE III: ACQUIRE RESOURCES 

There are a number of things that counterterrorism specialists should be looking 
for as a cell progresses to phase three: Acquire Resources. The first part of this phase will 
include a lot of surveillance as the cell continues to refine their plot. Early on in this 
phase counterterrorism specialists will look for suspicious individuals or just the same 
individual showing up to a site day after day. According to Mr. Holschen, Regional 
Manager of Triple Canopy (2007), “Surveillance is where we usually detect terrorists”, 
he continued to explain that this is where they are most observable and it is the weakest 
part of their lifecycle. Thus it would be advantageous for counterterrorism specialists to 
know that terror cells are forced to survey and in doing so they create a scenario that 
makes them observable and accessible. 

Additionally, if members of the cell are not U.S. citizens then it can be expected 
for the cell to thrive on fraudulent identification. Identity theft is a growing problem in 
the United States and does not appear to be on the decline (Identity Theft Resource 
Center, 2007). In the Millennial Bombing and Operation Bojinka members of the cells 
frequently used false identification. Additionally, in each scenario there were other key 
individuals that the terrorist used to supply their false identification and travel. From the 
law enforcement perspective, additional public training and education need to support 
and encourage the reporting of stolen identities. If identify theft victims know to report 
stolen identities with local police reports this will better enable law enforcement to “red 
flag” that ID. This will now act as a deterrent to this particular stolen identity and will 
further deter individuals trying to steal identities from continuing in this line of work. 
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Additionally, there needs to be more control on immigration laws, Ressam and Paris both 
functioned within their respective societies for years without ever being detained by 
immigration. Having a functional false ID makes it very easy for terrorists to move in and 
out of our society. By making this aspect of their plot more difficult it will slow or may 
even stop the process entirely. The goal of any terror cell during this phase is to operate 
fluidly but inconspicuously as plans and resources are finalized, anything that could 
jeopardize their anonymity would greatly hinder their progress. 

With the threat of homegrown cells higher than ever there is a silver lining - many 
of these were not specially trained in terrorist plots or attacks. When constructing the 
original cell, the terrorist will attempt to acquire field experts that will support the 
ultimate goal of their attack. However, anything that can not be performed by current 
members at this stage will need to be learned. lyman Paris had no idea how to acquire 
metal cutting blowtorches or train derailment tools - he was forced to talk to an 
acquaintance that he barely knew to get more information. Yousef and Murad 
accidentally blew up their kitchen while trying to construct their explosives. In other 
cases, like the Northern Virginia Jihad Group, members were seen performing tactical 
training exercises at a local paintball facility. The Portland Seven trained in martial arts, 
firearms, and paramilitary tactics at myriad rural areas around them. These homegrown 
cells although elusive can be detected. These cells will need a more time and training in 
order to be effective and this is a clear counterterrorism advantage that can not be 
overlooked. Purthermore, counterterrorism specialists will want to watch for fires / 
explosions in remote or unpopulated areas or civilians inquiring or practicing military 
training exercises, these are all possible indicators of cell planning. 

Based on the cases analyzed in this paper, one can develop a list of patterns to 
look for: 

1. Unusual purchasing patterns, good examples include Ressam’s interest in 
agricultural fertilizer and Yousefs large amounts of acquired explosives. 

2. Unusual interest in products or supplies like lyman Paris’s search for cable 
cutters and train derailment tools. 

3. Missing or stolen supplies like Ressam’s stolen chemicals from the 
agricultural plant in Vancouver. 
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4. Attempts to buy commercial / industrial / concentrated products like Paris’ 
interest in tools used on large bridges or Ressam’s interest in large scale 
farming fertili z ers. 

5. Unusual activities taking place in inconspicuous or unordinary locations 
such as the Virginia Jihad groups training at the Paintball facility or the 
Portland Seven’s paramilitary training in backwoods areas. 

6. Individuals with unusually large sums of cash on them which Yousef and 
Ressam operated on almost exclusively. 


Each of these may not necessarily mean a terror cell is present but these are strong 
indicators. For homegrown terror cells, the conspirators will face a very similar problem 
and will be forced to work through trial and error while acquiring all of their own 
resources for their plot. In the CERT (Community Emergency Response Team) training 
manual provided through the Department of Homeland Security, DHS cautions local law 
enforcement to be suspicious of things like 

■ Out of place and unattended packages, boxes, or vehicles . Terrorists have a 
long history of hiding explosive devices in packages, boxes, or vehicles. Items 
that are out of place and unattended could signal a possible terrorist attack. 

■ Packages that are leaking may be harmless—but they may also signal a 
terrorist incident. The terrorists who released Sarin in the Tokyo subway 
system (Aum Shinrikyo) merely poked holes in bags containing Sarin, then 
left the area as the poison leaked out. 

■ Materials or equipment that are unusual for the area. Dispersal devices, lab 
equipment, or quantities of hazardous materials that are not typically located 
in the area may indicate that a terrorist attack is occurring or is about to occur. 

■ Small explosions that disperse liquids, mists, or gases are an obvious sign that 
something is wrong. 

■ Unusual odors or tastes 

(Human Technology Inc, 2003, p.8-7) 


In general the CERT manual warns “Being aware of what is not in the 
environment that should be is as important as being aware of what is in the environment 
but is out of place” (Human Technology Inc, 2003, p.8-7). The above list contains 
physical or environmental factors that counterterrorism specialists should be aware of. 
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However, Post (2002, p.92) also details behavioral factors that could be equally as 
indicative of subversive training activity: 

1. Group members appear in known terrorist training camps, sites or 
organizations. 

2. Group members train in operational skills such as tradecraft (e.g. surveillance, 
counter-surveillance, and secure communications), weapons and explosives. 

3. The group engages in operations such as bank robberies, thefts, kidnappings 
requiring skills similar to terrorist operations. 

An essential part of planning is constant and reliable communications, something 
that also creates observables for counterterrorism specialists. As the plot progresses 
communications styles will change. The beginning of this phase will have many 
discussions with the cells leadership. As the cell becomes more trained and better 
prepared for execution the communication with cell leadership will wane. This is due to 
the fact that as the cell gets closer to execution, it will become more self-reliant and better 
able to make its own decisions on how the attack will be carried out. Furthermore, any 
communication that does take place whether that is between cell members or cell 
leadership will not be open. The communication methods used will be carefully placed 
and often coded so that messages can not be easily understood by onlookers or an 
eavesdropper. 

In general, counterterrorism specialists need to think in a broad encompassing 
view, something seen in isolation gives an entirely different viewpoint than when taken in 
context of the larger picture. For example, flight instructors from the Venice Florida 
training facility that trained three of the 9-11 conspirators “described Atta and Shehhi as 
aggressive and rude, and in a hurry to complete their training” (National Commission on 
Terrorism Attacks, 2004, p.6). Additionally, “according to their flight instructors, Hazmi 
and Mihdhar said they wanted to learn how to control an aircraft in flight, but took no 
interest in take-offs or landings” (National Commission on Terrorism Attacks, 2004, 
p.l4). This seen in hindsight suggests of information that was not even conceivable 
before 9/11. 
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D. PHASE IV: DECISION TO EXECUTE 

In this fourth phase, counterterrorism specialists should be cautious of smaller 
acts of violence. Many high profile plots always begin with a test execution. The list 
provided above by the CERT training manual cautions against sightings of certain 
environmental conditions. Those conditions could be evidence of the previous phase 
(training exercises) or this phase (test executions), either of which should be cause for 
immediate action by counterterrorism authorities. For example the attack on the USS 
Cole was preceded by A1 Qaeda operatives with an attack on the USS Sullivan. “A1 
Qaeda has repeatedly demonstrated its ability to test — and then return to — strike plans. 
For example, the attack against the USS Cole in October 2000 was at least the second 
attempted suicide strike against a U.S. naval vessel that year; the first was a failed 
attempt against the USS Sullivan in January” (Burton, The Fessons of the Fibrary Tower 
Plot, 2007). In the case studies being analyzed in this paper that came in the form of an 
explosion in a local theater and a smaller explosion on an airliner in Operation Bojinka. 
Additionally, Ressam given the opportunity would have left an empty suitcase 
inconspicuously around the Fos Angeles Airport to watch response times of employees 
and bystanders (Ollen, July 5, 2001). 

Furthermore, the disappearance of dangerous chemicals or strange purchasing 
patterns of any substance that in large quantity could cause harm should prompt further 
investigation. This phase has a large escalation component from previous phases, so there 
is considerable room for accidents or detection. It is imperative for counterterrorism 
specialists to think in a broad sense, because being able to see the larger picture may 
mean the difference between isolated incidents versus observing components of a larger 
plot. 

E. PHASE V: EXECUTION 

A cell at the execution stage will likely function as a well-trained, dynamic team. 
Each person in the cell has a role and completes that role independent of what other cell 
members are tasked. There will be minimal communications to trace and there will be no 
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need for monetary transactions since at this point all resources are in place. The only 
opportunity that counterterrorism specialists may have is that something suspicious draws 
their attention at the time of execution. 

The question becomes, "what is suspicion and where does it come from?’ Elliot 
Grollman, member of Washington’s Law Enforcement Working Group on Weapons of 
Mass Destruction (2007), in a recent personal interview described it as a “gut feeling and 
you can’t ignore that...You’ve got to go by behavior”. When the plan is in motion there 
is nothing left to act on but instinct itself. 

Ressam was on his way to pick up Meskini to transit to the execution location 
when border patrol became suspicious of Ressam’s behavior. Shortly after he was 
detained, explosives were discovered in the trunk of his vehicle. Likewise Yousef had 
tested everything to ensure that his plot would be a success but was discovered when a 
chemical fire started in the kitchen of his Manila apartment. Local authorities became 
suspicious of all the apparatus and chemicals in his apartment. Police eventually 
discovered the plans for the destruction of twelve airliners on a laptop that was left in the 
apartment after Yousef fled. 

At this point in the lifecycle of the terror cell it is literally do or die and we as 
citizens are entirely dependent on local counterterrorism authorities (police and first- 
responders). Thus it is imperative that local law enforcement be as informed and prepared 
as possible. This can be achieved in a variety of ways: creating local intelligence agencies 
that will collect, analyze and disseminate pertinent intelligences to local authorities as 
New York City Police Department has implemented. Likewise, a department could 
follow the Los Angeles Police Department model and create a joint task force with 
federal intelligence to create a constant dialogue that supports both entities. No matter 
what is put in place, any intelligence is better than none at all since local law enforcement 
know what looks right for their area. More often than not these officers have grown up in 
their community and know the people and day-to-day business of their town. As such a 
local officer will be much more likely to observe suspicious activity than a remote 
intelligence officer would. Making that local department as prepared and informed as 
possible is paramount. 
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F. CLOSING REMARKS 

“The relationship between nascent non-state organizations and the environments 
that create and nurture them remain largely unexplored;” however, we know that 
“organizations must interact with their environment to survive; it both consumes 
resources and exports resources to the environment” (Thomas, Kiser and Casebeer, 2005, 
p.xi, 11). These resources are all evidence that can be used by counterterrorism specialists 
to detect and deter plots within their environment. This paper takes a closer look at the 
relationship formed between a terror cell as it progresses through conception to execution 
and the impact that it has on the environment it exists in. Through the analysis of three 
major thwarted terrorist attacks we can discern that as a cell moves through its 
environment it leaves a trail of patterns. By evaluating those patterns and commonalities 
between cases I have created a notional model of the lifecycle of a terror cell into five 
main phases, as outlined above. 

Each phase is distinct, unique and touches different elements of the 
Counterterrorism structure. The initial phases of a terror plot will be much more 
dependant on intelligence communities since at this point in time the cell is in its infancy 
and there are only a few key figures involved. The main activities taking place include 
general brainstorming and the formation of a cell. There will not be a lot of actionable 
indicators at a local level whereas intelligences may be able to track the terrorist recruiter 
that has now moved into that area or communication trends in certain groups. 

As the cell moves into the third through fifth stages there will be more physical 
indicators in the local area of the cell since the cell will be surveying and training in the 
area of attack, acquiring resources, and performing test executions. Thus as the cell 
progresses from an idea to an actionable plot it will become incumbent upon local law 
enforcement to be aware of suspicious activities in their areas of expertise. 

Thomas, Kiser and Casebeer (2005, p.23) pose an intriguing question in response: 
“One way of preventing niche construction on the part of a developing VNSA [Violent 
Non-State Actor] would be to ask what affordances would this organization strive to 
make a part of its environment?” 
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The analysis of these case studies highlights what those affordances might be, and 
thus highlight patterns that will support the goals of counterterrorism authorities. Some of 
the patterns that emerge from this analysis include a growing relationship between terror 
cells and crime rings, the overwhelming dependency on fraudulent identification and 
other stolen goods, transitions in leadership as the cell progresses, the use of coded 
communication methods between cell members, and the realization that every cell no 
matter the plot must survey its target in some fashion. 

“Where as once we would have caught a robber red-handed and that would have 
been enough to satisfy the legal case, we now have to stop and ask ourselves, who is this 
robber? ... Is he stealing to feed a drug habit? OK, who is he buying his drugs from? Or 
is he robbing to raise funds to buy guns for a gang? Which gang? Who are his associates? 
Or is he part of organized crime or something else? The aim is to drill down into crime to 
get a complete picture of the crime landscape in your community.’’(Block, 2007) Chief 
Barton from the Los Angeles police department explains the issue of fighting the war on 
terror within our own country quite well in this previous quote by highlighting the 
growing connection between crime rings in our country and terrorism on an international 
scale. As a result of this paper a law enforcement officer or an intelligence analyst can 
now look at a situation and know what to look for. Furthermore, given certain feedback 
from the environment they will be able to see how progressed a certain plot may be. 

One thing that seems to be a recurring theme in terrorist activity is the use of 
fraudulent id in order to acquire resources both legally and illegally. Terror cells, by the 
very definition of their mission, need to travel. They must travel to communicate, train, 
acquire resources and plan, the only easy way to do this in today’s society is through 
fraudulent identification. In two of the case studies there was travel to or from 
Afghanistan for a meeting or training. Additionally, upon their return to the United States 
Fans and Ressam each brought a large amount of cash with them to start their resource 
acquisition phase. In Ressam’s case, he also brought back chemicals that would later be 
used to construct a bomb. 

Every terrorist group analyzed in this paper and most terrorism cases include 

travel from one location to an execution destination. Aydinli, author of Searching for the 
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Global Jihadists ’ Achilles Heel (2006, p.302) warns that we should be careful to only rely 
on money trails that are produced by these terror cells, but rather what that money trail 
supports. “Traditionally, terrorist groups have tended to view money-making as an 
essential collective effort...to raise money for the group’s operational costs. Not only do 
such money-making endeavors become an integral part of the group’s activities, but such 
a comprehensive system generally leads to established methods and routes...both greater 
opportunities for counter-terrorists to track down the money, and often significant results 
when they do”. Additionally, Aydinli explains that there is “continuing misconception of 
bin Laden and, subsequently, A1 Qaeda, as being financially limitless...costs are kept low 
both through the methods used and the general frugality of the terrorists” (2006, p.303). 

He suggests a better mechanism to track terrorist activities is their inclination 
towards transnational mobility; it is the very basis of their movements and belief. Terror 
cells want to make the biggest impact possible with each attack, thus bringing the attacks 
to U.S. or other Western nations will be ideal. In order for a cell to achieve this they will 
need to have the ability to travel here, get inside our country and operate freely within our 
borders. “If mobility is accepted as essential for successful operation of Jihadist terrorist 
network, and travel documents are clearly the tools with which the states can monitor 
such transnational mobility, it is essential to seek ways of coping with the dilemma that 
these key tools can be forged and manipulation techniques” (Aydinli, 2006, p.307). This 
is something that counterterrorist know terror cells will rely on and use, thus the 
prevention of fraudulent identifications and the enforcement of border control will be 
essential to our success in this war on terror. 

Once the cell was in place they would transition in leadership and begin to use a 
more coded and secretive communication methods. A plot, no matter its origination, 
would be approved and initially funded by a source. However, as the cell becomes more 
independent and self-reliant, the leadership will transition from an outside source to an 
internal hierarchy that is much more asymmetric in nature. Ressam’s cell needed initial 
approval from Abu Doha, but once the cell was into the acquiring resources phase, 
Ressam’s communication with Doha was discreet and becoming significantly less 
frequent. Likewise, Yousef had initial discussions with KSM and other A1 Qaeda 
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leadership, but onee he was in Manila the eell beeome mueh more autonomous. As the 
eell moves toward exeeution it will make its own deeisions on how to aeeomplish logistie 
issues; outside leadership is no longer neeessary and as sueh it spawns a ehange in 
leadership from external to internal. 

Additionally, the eell will move to a more guarded and seeretive eommunieation 
style. As the eell progresses its eommunieations with members outside the eell will wane 
and any eommunieations that take plaee will make use of ciphered language. lyman Paris 
used a language that was given to him by his superiors such as gas station for metal 
cutting torches or a mechanics shop for train derailment tools. This is not the first time 
we have seen coded language, other cases have used coded language as well. (Suskind, 
2006, p. 155-57). Ressam would just speak in Arabic if he did not want to be understood. 

Finally, realize that any terror plot will need to survey the site before attacking it 
and this is a major weakness in their progression. It is hard to survey a target without 
repeated and careful observation, something that makes these cell members readily 
observable. This can be highly beneficial to counterterrorism authorities. Ressam noted 
that when preparing for a terrorist act there is a number of precautions that can be 
completed to ensure their own success. These things included practicing to look like a 
tourist so that one can spend as much time as needed surveying their site of attack. Also 
when working within the cell, one must take care to preserve their own secrets from other 
members. Thus each person in the cell is operating on a need-to-know basis. Finally if 
speaking on a phone, ensure that you are using a controlled and normal tone so that 
eavesdroppers are not likely to take notice to your conversation. If that does not work 
then just speak in a different language. (Ollen, July 3, 2001, p.551-2) 

Counterterrorism specialists need to rely on their gut feeling of suspicion and 
always be aware of what is taking place within the environment they exist in; to realize 
something abnormal is taking place. These specialists have the advantage that they are 
experts in their own field, they know their area and what normal operations look like; 
terrorists do not have this benefit. They are coming in from another area and trying their 
best to blend in, but an expert will be able to tell the difference. 
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In general we see that information provided to counterterrorism authorities is 
extremely dependent on connectivity and information flow. “The government’s so called 
war-on-terror is about making friends” (Suskind, 2006, p.48). In order to be successful in 
our attempts to combat the war on terror there needs to be an emphasis on ensuring that 
information flow is frequent, stable and secure from the top most member of the CIA 
down to the law enforcement officer in the New York City subway. Being able to rely on 
information cues in the environment means that someone has to be there to observe such 
changes, thus if one person observes something out of the ordinary he needs to be able to 
inform anyone necessary to ensure that the proper response is completed in enough time 
to make a difference. This type of response can only be accomplished when 
communication pathways are open and frequent. 

In each case study there is a certain progression with the cell development and 
known weaknesses for that stage. By realizing that certain weaknesses exist, 
counterterrorism specialists can use that information to their advantage to exploit that 
stage limitation. In order to be successful with terrorist attacks there needs to be an 
increase in communication and a realization that each phase brings different aspects to 
the forefront. Counterterrorism specialists will need to consider each stage in terms of 
how they can affect that phase. Each step in the process of a terror cell lifecycle brings 
with it different cues within its environment, as such each phase requires a different set of 
counterterrorism tools, expertise and authorities. Mr. Grollman, member of Washington’s 
Law Enforcement Working Group on Weapons of Mass Destruction (2007), in a recent 
interview said “Sharing information is critical, communication is critical”. 
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